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ABSTRACT 


In March of 2002, through the Homeland Security Presidential Directive 3, 
the Homeland Security Advisory System (HSAS) was developed. The original 
intent of the HSAS was to provide a warning mechanism for the federal 
government; other state and local agency responses were voluntary. However, 
the intent expanded to include a warning system for local, state, federal 
agencies, the private sector and the general public. 

Five orange alerts later, the confusion continues with a mix of 
complacency and misunderstanding. State and local officials complain about the 
general nature of the intelligence and the lack of specificity directed at regions or 
targets. The cost of orange protective measures is adding up into the billions of 
dollars. Warnings specific to New York City have a different value in Utah. 

Solutions require a new federal intelligence culture with a new name and 
location under the direction of the Department of Homeland Security distributing 
specific intelligence. We need highly trained intelligence analysts working with 
multi-agency state or metropolitan fusion centers. The media should help in 
educating the public on the HSAS and promoting volunteer organizations, 
encouraging participation to assist in Homeland Security and to reduce the fear 
of a catastrophic event. 

Customized HSAS should be developed for each community, state and 
private sector business to better utilize protective resources. Protective 
measures should be implemented with specific intelligence to support the 
elevation of the HSAS. 
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EXECUTIVE SUMMARY 


The Homeland Security Advisory System (HSAS) was announced by 
Secretary Ridge in March of 2002 as part of Homeland Security Presidential 
Directive 3. The original intent of the HSAS was to provide a warning mechanism 
for the federal government; other state and local agency responses were 
voluntary. However, the intent expanded to include a warning system for local, 
state, federal agencies, the private sector and the general public. The system 
was confusing and no one understood it. 

The system consists of five color codes each associated with a threat level 
and specific protective measures designed to protect or deter terrorist attacks. 1 

Low Condition- Green - is a low risk of terrorist attacks. 

Guarded Condition- Blue - is a general risk of a terrorist attack 

Elevated Condition- - is a significant risk of terrorist attacks 

High Condition - Orange- is a high risk of terrorist attacks. 

Severe Condition- Red -is a severe risk of terrorist attacks 

PROBLEMS WITH THE HOMELAND SECURITY ADVISORY SYSTEM 

Since the inception of the HSAS, there have been five national changes in 
the designation to orange, each time the threats have been generalized to the 
nation. Each time the threat level goes up federal, state and local jurisdictions 
implement or deploy costly protective measures. Mayors estimate these 
measures are costing 70 million per week under Orange. 2 Another estimate 
according to David Heyman is the orange advisory is costing the nation one 
billion per week including DHS 


1 Department of Homeland Security, Homeland Security Advisory System, March 2002. 

2 Gorman, Siobhan, “State, Local Officials Begin to Question Homeland Security Price Tag,” 
National Journal, April 21,2003. 
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operations, state and local governments and the private sector. 3 There are many 
states and localities that are in deficit spending and cannot continue to respond 
each time the HSAS changes with non-specific threat information. 

The system is too general to differentiate from an orange level in New 
York City and an orange level in Utah. Currently, it does not matter what the 
location of the jurisdiction when the HSAS is raised to an orange the entire nation 
is at orange. There are eleven states and countless local jurisdictions that have 
taken matters into their own hands and modified the HSAS to fit their needs. For 
example, Hawaii has added a black level which means an attack has occurred 
and New York City has three colors, orange, dark orange and red. 

The point is, many jurisdictions have identified the problems and are 
making adjustments and not waiting for the federal government to tell them what 
they should do to modify the HSAS. 

ELEMENTS OF AN EFFECTIVE HOMELAND SECURITY ADVISORY SYSTEM 

Case studies were conducted in New York City and urban and rural 
communities in Utah. The analyses of the case studies conclude with the 
following list of specific recommendations needed to develop an effective 
Homeland Security Advisory System. 

• Specific international and domestic intelligence sources should be 
integrated into all intelligence systems. Intelligence should be 
narrowed down to the region, state or community. Information 
should refer to the entire region or just a specific infrastructure, for 
example pipelines or Embassies. Specificity allows for very 
detailed actions to be taken in support of the Homeland Security. 

• The HSAS is dependent on timely accurate useable 
intelligence. Critical information should be posted on secure 
Intel websites for other Intel agencies to utilize. There 
should be a new culture in federal intelligence systems; it 
should have a new name in a new location under the 


3 Chris Strohm, “Homeland Security May Alter Threat Advisory System,” Government 
Executive Magazine, January 9, 2004, David Heyman is quoted in the article and is the director of 
science and security initiative at the Center of Strategic and International Studies. 
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direction of DHS. The traditional barriers within the 
intelligence community will never be broken down in time to 
prevent the next terrorist act. 

• Intelligence work for state and local agencies is a complex 
assignment. Working in intelligence is not something 
assigned because of a disciplinary action or because a 
person is recovering from an injury. An intelligence analyst 
requires very technical training and years of experience and 
should be paid accordingly to keep the individual in the 
position. 

• Each state or large metropolitan area jurisdiction, similar to New 
York City or the Los Angeles 4 area should have a fusion center for 
intelligence. A localized fusion center is important because there 
should be a focal point where local intelligence can be fused with 
federal intelligence and dispersed to all jurisdictions. Connection to 
the federal Terrorist Threat Integration Center (TTIC) and to local 
intelligence jurisdiction is critical to the sharing of information. Each 
center should be co-located with the Joint Terrorism Task Force 
(JTTF) to build trust and to enhance the flow of information sharing 
horizontally and vertically. Membership in the fusion centers should 
include federal, state and local public safety agencies. 

• The HSAS should be adapted or customized to include specific 
protective measures when the threat information is localized. Each 
community, state government and the private sector should 
develop and exercise an HSAS similar to the ones described in 
Appendix B or C. 

• A simple effective notification system should be implemented 
from the federal government to the state and to the local 
jurisdictions. The system should have the capability to be 
activated from either the federal, state or local jurisdiction. 
The technology is available to allow for one button activation 
for a nation wide system that provides timely notification. 

• There should be a comprehensive proactive public understanding 
of what the advisory system means national and locally. The public 
should be well educated through media public service 
announcements, volunteer training, school and work awareness 
programs to enhance the knowledge base, the response 
capabilities and the continuity of business. If the citizens recognize 
what is going on during any pre or post disaster scenario, the 

4 The Terrorism Early Warning (TEW) Group located in the Los Angeles County area is 
composed of law enforcement, fire, health and emergency management agencies. Their purpose 
is to gather information and intelligence and analyze the threat and the risk to the area and 
prepare responses for such attacks. 
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community’s ability to deal with human-caused or natural disasters 
is increased and the psychological impact of fear is decreased. 
This will allow the recovery process to move forward and begin the 
healing and return to normalcy as soon as possible. 

The public, pubic safety agencies and the private sector have all 
experienced the wave of confusion from the HSAS. Since the unveiling of the 
HSAS in March 2002, several common themes have emerged; what does this 
mean to my agency, my community, my business or what does it mean to me. 
The maturing process of the advisory system has solved some of the issues. 
Each public safety agency will provide the necessary level of protection and 
response regardless of the HSAS based on the intelligence they receive. The 
private sector is going to build redundancy in their business to stay in business or 
shorten the recovery time. The general pubic still looks to their government for 
support and guidance during times of crisis. The element of fear management 
and the reduction of psychological impacts are reduced with the involvement of 
the pubic. There is a sense of purpose and belonging to a volunteer group who 
identifies with a specific mission. The level of training and exercises eases 
anxiety and enables the volunteer to participate, function and contribute to the 
cause. 

The Homeland Security Advisory System is a part of larger Homeland 
Security strategy for the nation to prevent, deter, respond and recover from a 
terrorist act. It is an example of the collaborative culture we must promulgate 
around the country in all jurisdictions. We must share, communicate, and we 
must involve our citizens, our public safety agencies, and the private sector in a 
comprehensive strategy for providing a safer homeland. 
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I. INTRODUCTION 


A. HOMELAND SECURITY ADVISORY SYSTEM 

The Homeland Security Advisory System (HSAS) is flawed, because it is 
misleading and falls short of accurately warning a nation of potential terrorist 
attacks. The HSAS attempts to enforce a high standard that is too vague and 
costly for federal, state and local protective measures. Changes can be made in 
the HSAS to provide timely detailed information and efficient application of 
protective measures. The general public is confused with each advisory, which 
has lead to extreme behaviors ranging from purchases of large amounts of duck 
tape and plastic to complacency, lack of interest and no action. The HSAS 
needs improved information networks that generate specific intelligence to be 
shared with state and local jurisdictions regarding threats to infrastructure. 
Increased public awareness and involvement in volunteer programs will reduce 
exaggerated behaviors and psychological effects on the public. 

The HSAS is important to the nation to aid in the prevention, deterrence, 
and mitigation of terrorist attacks. The color-coded system allows communities, 
cities, states and a nation to mobilize law enforcement, military and public safety 
professionals to provide increased vigilance and protection. If the HSAS is 
modified to meet the needs of the stakeholders utilizing specific intelligence to 
support the advisory system and provide specific warnings, then we will be able 
to increase our ability to respond to prevent and deter terrorism. 

This thesis analyzes flaws in the HSAS through case studies from several 
communities in Utah and a case study of New York City. Examples are used 
from the Israeli culture, which has fought terrorism for over 50 years. Articles 
and other literature will be used to assist in identifying gaps in our intelligence 
systems, which have attempted to change since September 11 th , but have not 
gone far enough. Cultural change and the adjustments necessary to reduce the 
psychological 
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impact of extreme behavior within the general public are also examined. Specific 
recommendations to the HSAS are made to demonstrate the specific steps to be 
taken to customize advisory systems for each community and state. 

A summary of the cases studies from Utah, New York City and the Israelis 
compared against the current HSAS reveals several key points: 

• Counter terrorism intelligence is not detailed enough to focus 
resources in specific areas of prevention and deterrence. 

• Intelligence systems have improved since September 11 th , 
but have not gone far enough to broaden information sharing 
horizontally and vertically. 

• There is not a consistent organized intelligence structure at 
the state and metropolitan level for intelligence gathering 
and dissemination with local jurisdictions. 

• There is not a professional training certification for 
intelligence analysts, which are often randomly assigned 
with frequent turnover. 

• When the HSAS is elevated to orange, it applies to the nation. 

• Public safety agencies and the public do not pay attention to 
the national advisory system. 

• Each public safety agency will provide the necessary level of 
protection and response regardless of the HSAS based on 
the intelligence they receive. 

• There is a lack of public understanding of the HSAS. 

• During the first alerts, there was a general lack of 
understanding of the system by the public. 

• There was confusion of what protective steps the public 
should take. 

• Today, the public does not pay attention to the warnings. 

• The Israelis can provide us with lessons because they have battled 
terrorist attacks for 55 years. They have found that one of the most 
successful tools in the fight against terrorism is public awareness 
and involvement. 

Recommendations to improve the HSAS include a change in the national 
intelligence structure, more specific triggers in the HSAS to localize the warning 
and increased public awareness and involvement. 
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• Specific international and domestic intelligence sources should be 
integrated into all intelligence systems. Intelligence should be 
narrowed down to the region, state or community. Information 
should refer to the entire region or just a specific infrastructure, for 
example pipelines or Embassies. Specificity allows for very 
detailed actions to be taken in support of the Homeland Security. 

• The HSAS is dependent on timely accurate useable 
intelligence. Critical information should be posted on secure 
Intel websites for other Intel agencies to utilize. There 
should be a new culture in federal intelligence systems; it 
should have a new name in a new location under the 
direction of the Department of Homeland Security (DHS) 
because the traditional barriers within the intelligence 
community will never be broken down in time to prevent the 
next terrorist act. 

• Intelligence work for state and local agencies is a complex 
assignment. Working in intelligence is not something 
assigned because of a disciplinary action or because a 
person is recovering from an injury. An intelligence analyst 
requires very technical training and years of experience and 
should be paid accordingly to keep the individual in the 
position. 

• Each state or large metropolitan area jurisdiction, similar to New 
York City or the Los Angeles 5 area should have a fusion center for 
intelligence. A localized fusion center is important because there 
should be a focal point where local intelligence can be fused with 
federal intelligence and dispersed to all jurisdictions. Connection to 
the federal Terrorist Threat Integration Center (TTIC) and to local 
intelligence jurisdiction is critical to the sharing of information. Each 
center should be co-located with the Joint Terrorism Task Force 
(JTTF) to build trust and to enhance the flow of information sharing 
horizontally and vertically. Membership in the fusion centers should 
include federal, state and local public safety agencies. 

• The HSAS should be adapted or customized to include specific 
protective measures when the threat information is localized. Each 
community, state government and the private sector should 
develop and exercise an HSAS similar to those described in 
Appendices B or C. 

• A simple effective notification system should be implemented 
from the federal government to the state and to the local 
jurisdictions. The system should have the capability to be 


5 Ibid. 
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activated from either the federal, state or local jurisdiction. 
The technology is available to allow for one button activation 
for a nation wide system that provides timely notification. 

• There should be a comprehensive proactive public understanding 
of what the advisory system means national and locally. The public 
should be well educated through media public service 
announcements, volunteer training, school and work awareness 
programs to enhance the knowledge base, the response 
capabilities and the continuity of business. If the citizens recognize 
what is going on during any pre or post disaster scenario, the 
community’s ability to deal with human-caused or natural disasters 
is increased and the psychological impact of fear is decreased. 
This will allow the recovery process to move forward and begin the 
healing and return to normalcy as soon as possible. 

B. ORGANIZATION 

This thesis has five chapters. Chapter I, “Introduction,” introduces the 
Homeland Security Advisory System failures, the importance of the HSAS for 
Homeland Security and summarizes the keys points from the case studies from 
Utah, New York City and the Israelis. Recommendations and solutions to 
modifying the HSAS are summarized. 

Chapter II, “Homeland Security Advisory System,” covers the beginning of 
the HSAS, the purpose of the system and why is it necessary for the nation to 
have one to fight terrorism. What was the nation’s reaction to the elevation to 
orange. What is the effect of a broad nation-wide alert on state and local public 
safety jurisdictions. What are the goals of the HSAS and a state HSAS. 

Chapter III, “Case Studies,” will analyze the reaction to the HSAS by 
several jurisdictions in Utah and by the New York City Police Department and the 
Fire Department of New York City. 

Chapter IV, “Summary and Recommendations,” summarizes the case 
studies and makes recommendations to fix the HSAS. 

The summary points of this chapter are: 

• Confusion was wide spread throughout the United States. 

• Local jurisdictions expected the state and federal governments to 
explain what the system means and how to respond. 
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• Local jurisdictions depend on the state and federal intelligence 
networks to share information, primarily the JTTF for specific 
intelligence. 

• Local jurisdictions depend on the federal and state governments for 
timely notification, not the cable news networks. 

• State and local jurisdictions will provide the necessary protective 
and response measures to prevent an attack regardless of what the 
color code is. 

• Public relations are very important in delivering a message to the 
public. 

• Public involvement through volunteer organizations and 
participation will assist in the protective; prevention and response 
measures implemented and also minimize the psychological 
impact. 

Chapter V, “Conclusions,” summarizes the findings and makes specific 
recommendations for modifications in the HSAS to aid local and states 
jurisdictions as well the private sector to react to specific information. The alert 
information received to date, has been very general in nature. The state and 
local public safety jurisdictions need specific intelligence regarding terrorist 
attacks, to allocate resources properly for protective and response measures. 
DHS did improve the nature of the specific intelligence and alert information 
during the last orange alert during December 2003 and January 2004, but it is 
still not specific enough. The cost of protective measures is a burden to all 
communities and they will either bankrupt themselves into protection or they 
won’t do anything. 

The states and metropolitan areas need intelligence fusion centers to 
collect and disseminate intelligence from the federal intelligence community to 
the local intelligence community and visa versa. Well-trained intelligence analysts 
should be apart of the operation. State and metropolitan fusion centers should 
be co located with the JTTF. 

The DHS national notification system for a terrorist attack is the 

responsibility of DHS. However, the HSAS notification system should have the 

flexibility to activate from the local jurisdiction as well activated from the state 

level. The local jurisdictions depend on the state governments to relay the 
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information from the federal government to the local level, not the cable news 
networks. So far the cable news networks have been able to speculate on the 
elevation of the HSAS to orange and provided a timely accurate message. There 
is technology available to provide instant one button messaging that would 
simultaneously notify those who need to know. 

Each individual, community, state and private sector business should have 
a customized Homeland Security Advisory System. The HSAS charts should 
reflect accurate and specific measures to be implemented upon the elevation of 
the HSAS. (See Appendices B and C) 

Utilizing the media to send out accurate information about terrorist 
warnings will help to reduce the level of fear and panic among citizens. The 
involvement of citizens will help in Homeland Security vigilance and assist local 
and state agencies in the response to terrorist attacks. The Israelis have utilized 
a robust civil guard over the last 30 years to help deal with the variety of terrorism 
attacks and recovery from attacks. This has helped in dealing with the death and 
destruction that the terrorists leave behind. 
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II. HOMELAND SECURITY ADVISORY SYSTEM 


This chapter discusses alert systems; their benefits and why they are 
needed to fight terrorism. The Homeland Security Advisory System (HSAS) and 
its purpose, the misinterpretation of Homeland Security Presidential Directive 
(HSPD) 3, the goals of the HSAS and the proposed state goals of the HSAS. 
The chapter concludes by identifying problems with the HSAS. 

A. ALERT SYSTEMS 

An alert system is an effective tool to alert the public, public safety and the 
private sector of imminent danger. A warning system for domestic threats of 
terrorism would allow the application of protective measures to reduce or deter a 
terrorist attack. Preparation for the general public means having a 72-hour kit for 
each individual, having an emergency plan and participating as community 
volunteers. Public safety officials will have the opportunity to mobilize protective 
and preventive measures and pre-deploy response resources. The private 
sector would prepare and implement a continuity of business plan to enhance the 
ability to return to business as usual as soon as possible. The objective is to 
minimize down time, mitigate the damage and minimize the loss of life and 
property. 

A warning system for terrorism is very similar to the Emergency Alert 
System (EAS), which has been used for warnings of pending storms. This 
system has been in place for years and is often tested on radio and television 
stations. The EAS is used for imminent storms, such as a tornado, and is 
activated when lives or property are threatened. This allows for protective 
measures to be taken by those in its path. 

During the Cold War, the Pentagon established DEFCON or defense 
condition levels to activate defense measures to prepare for a nuclear threat. 
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Civil defense systems were also developed to alert the general public of 
imminent attacks. 6 In the 1960’s and 1970’s, air raid sirens and drills were very 
common in schools and communities in response to a nuclear attack. 

Warning systems are not a new phenomenon for defense forces or the 
public and have been successfully applied in warnings for violent storms, 
hurricanes and tornados. The HSAS is the new generation warning system for 
Homeland Security. However, in this case, if the HSAS is compared to the EAS, 
one might surmise that when the HSAS is raised to orange, the nation is bracing 
for a tornado that could touch down anywhere in the United States. 

B. HOMELAND SECURITY ADVISORY SYSTEM 

President Bush named Tom Ridge, Director of the Office of Homeland 
Security on September 19, 2001. In March 2002, through the Homeland Security 
Presidential Directive 3, the Homeland Security Advisory System (HSAS) was 
unveiled. 7 The National Strategy for Homeland Security was released in July 
2002. Included in the strategy under the critical mission area of Intelligence and 
Warning, is the directive to “Implement the Homeland Security Advisory System.” 
It is critical for intelligence and the HSAS to function in concert with each other 
because there are dependent upon each other. 

The intent of the HSAS is to provide a warning mechanism for the federal 
government. Other state and local agency responses were voluntary. However, 
the original intent expanded to include a warning system for local, state, federal 
agencies, the private sector and the general public. 

The Homeland Security Advisory System disseminates information 
regarding the risk of terrorist acts to federal, state and local 
authorities, the private sector and the American people. The 
Advisory system creates a common vocabulary, context, and 
structure for the ongoing national discussion about the nature of the 
threats that confront the homeland and the appropriate measure 
that should be taken in response. It seeks to inform and facilitate 
decisions appropriate to different levels of government and to 

6 Dr. James Jay Carafano, “Homeland Security: Alerting the Nation,” March 18, 2004, The 
Heritage Foundation, Delivered to the House Subcommittee on National Security, Emerging 
Threats, and International Threats. 

7 Office of Homeland Security, Homeland Security Advisory System, March 2002. 
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private citizens at home and at work. The Department of Homeland 
Security is responsible for managing the Advisory System. 

The Advisory System provides a national framework for public 
announcements of threat advisories and alerts to notify law 
enforcement and state and local government officials of threats; 
they serve to inform the public about government preparations, and 
to provide the public with the information necessary to respond to a 
threat. The Advisory System characterizes appropriate levels of 
vigilance, preparedness and readiness in a series of graduated 
threat conditions. Each threat condition has corresponding 
suggested measures to be taken in response. Such responses 
include increasing surveillance and critical locations, preparing to 
execute contingency procedures, and closing public and 
government facilities . 8 

The HSAS consists of five color codes each associated with a threat level 
and specific protective measures designed to protect or deter terrorist attacks. 


Low Condition- Green - is a low risk of terrorist attacks. 

Guarded Condition- Blue - is a general risk of a terrorist attack 
Elevated Condition- Yellow- is a significant risk of terrorist attacks 
High Condition - Orange- is a high risk of terrorist attacks. 

Severe Condition- Red -is a severe risk of terrorist attacks 9 


The following in an example of the protective measures for orange; 

• Coordinating necessary security efforts with Federal, State, and 
local law enforcement agencies or any National Guard or other 
appropriate armed forces organizations; 

• Taking additional precautions at public events and possibly 
considering alternative venues or even cancellation; 

• Preparing to execute contingency procedures, such as moving to 
an alternate site or dispersing their workforce; and 

• Restricting threatened facility access to essential personnel only 10 

Included with the orange protective measures are the protective measures 

from blue, green and yellow added to each other. (See Appendix A for the 
complete listing) 


8 National Strategy for Homeland Security, Office of Homeland Security, July 2002. 

9 Office of Homeland Security, Homeland Security Advisory System, March 2002. 

10 Ibid. 
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The HSAS is obligatory to the executive branch of government and is 
suggested or voluntary to other levels of state and local government and the 
private sector. 11 The HSAS since has been used, as a guide for the nation with 
the implication the system was inclusive for the entire nation, not voluntary. This 
is another twist to a system with honorable intentions to educate, not confuse the 
public, public safety and the private sector. Steven Brill claims the color-coded 
system was never intended for the public, but was designed for government. 12 In 
any case, today the HSAS is perceived to be a national comprehensive 
Homeland Security Advisory System to be used by all. 

The Homeland Security Act of 2002 transferred the responsibility of 
administering the HSAS from the Attorney Generals office to the Secretary of 
Homeland Security and specifically the Under Secretary for Information Analysis 
and Infrastructure Protection (IAIP). 

The responsibility of gathering and analyzing intelligence to determine the 
nature and the scope of the threat potential against the United States also lies 
within the responsibility of IAIP. It is important that intelligence and the HSAS are 
closely tied together, because good intelligence is needed to determine the level 
and specificity of the alert. 13 

Section 201. Under Secretary for Information Analysis and 

Infrastructure Protection 

This section specifies primary responsibilities of the Under 

Secretary for Information Analysis and Infrastructure Protection. 


11 Office of Homeland Security, Homeland Security Advisory System, March 2002, this adds 
to the misconception of the purpose of the HSAS. The perception is the system is inclusive of all 
federal, state and local areas. 

12 Steven Brill, ‘One on One”, Government Security News, April 2004, pp. 34-35, Steven Brill 
is Chairman of The America Prepared Campaign, Inc., a non-profit organization aimed at 
educating Americans on how they can prepare themselves and their families for a terrorist attack. 
He is author of the critically-acclaimed, “After: How America Confronted the September 12th Era”, 
Brill enlightens audiences on the safety and security issues America must confront post- 
September 11th, the challenges faced by the legal system and law firms in this modern, global 
society, and the media's role and responsibility in today's rapidly changing world. Brill has been a 
columnist for Newsweek since September 11 tfi and an analyst for NBC on issues related to the 
aftermath of the terrorist attacks. 

13 Homeland Security Act of 2002, analysis of Section 1, Title II, sec 201, 
http://www.whitehouse.gov/deptofhomeland/analvsis/ , accessed May 2004. 
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These include: (1) receiving and analyzing law enforcement 
information, intelligence, and other information in order to 

understand the nature and scope of the terrorist threat to the 

American homeland and to detect and identify potential threats of 

terrorism within the United States; (2) comprehensively assessing 
the vulnerabilities of key resources and critical infrastructures; (3) 
integrating relevant information, intelligence analyses, and 
vulnerability assessments to identify protective priorities and 
support protective measures; (4) developing a comprehensive 
national plan for securing key resources and critical infrastructures; 

(5) taking or seeking to effect necessary measures to protect those 
key resources and infrastructures; (6) administering the Homeland 
Security Advisory System, exercising primary responsibility for 

public threat advisories, and providing specific warning information 

to state and local governments and the private sector, as well as 

advice about appropriate protective actions and countermeasures; 

and (7) reviewing, analyzing, and making recommendations for 
improvements in the policies and procedures governing the sharing 
of law enforcement, intelligence, and other information relating to 
homeland security within the federal government and between the 
federal government and state and local governments. 14 

The responsibility of raising and lower the HSAS rests with the Under 
Secretary of IAIP under the direction of the Homeland Security Council (HSC). 15 
Each time the HSAS is elevated the HSC meets to discuss and decide if the 
intelligence warrants the raising of the alert. Once they have directed the 
elevation of the alert, they ensure the application of governmental policies and 
directives and monitor compliance with the predetermined protective measures 
and other responses. 

1. Goals of the HSAS 

The National Strategy for Homeland Security clearing identifies specific 
goals for the HSAS. They are: 

• The Advisory System provides a national framework for public 
announcements of threat advisories and alerts to notify law 
enforcement and state and local government officials of threats; 


14 Homeland Security Act of 2002, analysis of Section 1, Title II, sec 201, 
http://www.whitehouse.gov/deptofhomeland/analvsis/ , accessed May 2004, underlined by author. 

15 The Homeland Security Council is made of the President, Vice President, Secretary of 
Homeland Security, The Attorney General, Secretary of Defense and other designated by the 
President. The purpose of the HSC is to coordinate the policies and functions of the United 
States Government relating to homeland security. 
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they serve to inform the public about government preparations, and 
to provide the public with the information necessary to respond to a 
threat. 

• The Advisory System characterizes appropriate levels of vigilance, 
preparedness and readiness in a series of graduated threat 
conditions. 

• The HSAS identifies appropriate protective measures to implement 
in response to the threat conditions. 

The goals or purpose of the HSAS includes alert notifications down to the 
state and local governments as well as the private sector and the general public. 
The language from the HSPD #3 states the HSAS is binding to the federal 
government and recommended but voluntary to the state and local agencies. It 
is important to note, the two directives confuse and confound what the intent of 
the warning system is. This may explain problems and issues to be covered in 
the next chapters. It is clear by the response of the nation to the alerts, that all 
public safety agencies at the federal, state and local levels have accepted or at 
least acknowledge the warnings. 

2. The State Goals for HSAS 

A Homeland Security Advisory System that is beneficial to state and local 
jurisdictions is a terrorist warning system that is activated from the state or local 
level dependent upon specific accurate intelligence and the imminent threat. The 
goals are: 

• The Homeland Security Advisory System provides a state and or a 
local framework for public announcements of threat advisories and 
alerts to notify law enforcement, public safety, state and local 
government officials of threats; they serve to inform the public 
about state and community preparations, and to provide the public 
with the information necessary to respond to a threat. 

• The HSAS identifies specific levels of vigilance, preparedness and 
readiness in a series of graduated threat conditions specific to the 
state and local community. 

• The HSAS identifies specific protective measures to implement in 
response to the threat conditions. 

C. PROBLEMS WITH THE HOMELAND SECURITY ADVISORY SYSTEM 

Since the inception of the HSAS, there have been five national changes in 

the designation, each time the threat advisory has elevated to orange and have 
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been generalized to the nation. The nation has responded by changing the 
threat level to orange. Each time the threat level goes up federal, state and local 
jurisdictions implement or deploy costly protective measures. Mayors estimate 
these measures are costing 70 million per week under orange. 16 Another 
estimate according to David Heyman is the orange advisory is costing the nation 
one billion per week including DHS operations, state and local governments and 
the private sector. 17 There are many states and localities that are in deficit 
spending and cannot continue to respond each time the HSAS changes with 
non-specific threat information. 

The system is too general to differentiate from an orange level in New 
York City and an orange level in Utah. Currently, it does not matter what the 
location of the jurisdiction when the HSAS rises to an orange the entire nation is 
at orange. There are eleven states and countless local jurisdictions that have 
taken matters into their own hands and modified the HSAS to fit their needs. For 
example, Hawaii has added a Black level which means an attack has occurred 
and New York City has three colors, orange, dark orange and red. 

The point is, many jurisdictions have identified the problems and are 
making adjustments and not waiting for the federal government to tell them what 
they should do to modify the HSAS. 

D. INTELLIGENCE 

If intelligence is specific to New York City, then NYC should make the 
necessary adjustments for protection and security. Why, in this instance, should 
Utah go to an orange? If there is a tornado warning in Oklahoma, why should 
Utah brace for it. It is a waste of time and resources. The HSAS has to be 
modified to fit each jurisdiction. Protective measures should be adjusted to fit 
each specific community or business. 


16 Gorman, Siobhan, “State, local Officials Begin to Question Homeland Security Price Tag,” 
National Journal, April 21,2003. 

17 Chris Strohm, “Homeland Security May Alter Threat Advisory System”, Government 
Executive Magazine, January 9, 2004, David Heyman is quoted in the article and is the director of 
science and security initiative at the Center of Strategic and International Studies. 
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It is clear that the federal intelligence community should be overhauled, it 
needs a new identify, new location and new culture. Information sharing 
between the federal government, the state and local jurisdiction should be shared 
freely horizontally and vertically. The old culture of the United States Secret 
Service, the Federal Bureau of Investigations and the Central Intelligence 
Agency is too bogged down in the traditional sharing of information to implement 
the needed changes before the next attack. 

E. PUBLIC AWARENESS 

To date U. S. citizens have responded with extreme behaviors and 
confusion over their role in response to the elevation of the threat level. The term 
shelter in place sent many citizens to the stores in search of duck tape and 
plastic and gas masks. These are extreme reactions and there are also 
complacent reactions, those who don’t believe the HSAS has any relevance and 
that a terrorist act on US soil was a one-time occurrence. 

DHS did not have a media campaign early in the release of the HSAS. 
The general public knew only enough about the HSAS to cause panic. DHS 
should have used public service announcements, training and education of state 
and local leaders, templates to develop state and local plans and efforts to 
thoroughly explain the purpose and protocol of the system. Confusion would 
have been reduced, the over reaction of protective measures would have been 
substantially minimized. 

A majority of U.S. citizens say they want to help prevent another terrorist 
attack but do not know how. 18 Public involvement through volunteer 
organizations has served the Israelis well and helped their culture mature enough 
to treat the bomb explosion like a car accident. Get in, clean it up and move on. 
Involving the public has reduced the fear and the psychological impacts of 
terrorism. There are very valuable lessons to learn from the Israelis as we 
attempt to define the threat, risk, vulnerability and the impact of terrorism. 19 

18 Chris Strohm, “Americans on Homeland Security: Ready Willing but Uniformed,” 
Govexec.com, May 25, 2004, An article reviewing a report from the Council for Excellence in 
Government “We the People: Homeland Security from a citizens perspective”. 

19 Please reference Appendix D for more details on the Israeli strategy for fighting terrorism. 
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The United States has a foundation of volunteer organizations already 
established with a tradition of care and assistance worldwide. The collaboration 
of all the volunteer groups will help direct volunteer resources to their fullest 
utilization. 
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III. CASE STUDIES 


This chapter will address the Homeland Security Advisory System issues 
that Utah and the City of New York experienced shortly after the implementation 
of the HSAS in March 2002. The case studies were developed from a list of 
questions asked during interviews with city, county and state leaders. Each case 
will unveil similar issues, concerns, and apply solutions to solve local 
jurisdictional issues. This is a reflection of what is really happening at the ground 
level. 

A. UTAH CASE STUDY 

In March of 2002, the White House Office of Homeland Security presented 
the Homeland Security Advisory System. At the state level, there was a lot of 
curiosity and lack of specific information regarding this new system. The 
Governor’s Homeland Security Task Force under the direction of Utah 
Department of Public Safety Commissioner and Homeland Security Advisor, 
Robert Flowers took an aggressive approach to develop protocols and protective 
measures to fit within the national HSAS. The Task force proposed a solution to 
the vagueness of the federal system by developing a model HSAS specific to 
Utah. 20 The big question, what does this mean to Utah? 

The task force developed the Utah version (or a state and local version) of 
the National HSAS (see Appendix B). It is very similar to the national model, but 
is more specific to the state or the local area. The system was simple, 
straightforward and understandable. The Office of Homeland Security asked if 
they could use Utah’s model as an example of a best practice. The Utah 
Homeland Security Advisory System was approved for use. 

The first official national elevation of the HSAS was in September of 2002. 
Officials in Utah followed with the rest of the nation, but questioned what Utah 
was doing to increase the security and other protective measures. In February 

20 Utah Governor Michael Leavitt created the Utah Homeland Security Task Force in October 
2001. This Task Force was under the direction of Commissioner Robert L. Flowers of the Utah 
Department of Public Safety. 
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2003, the nation’s level was again raised to an orange advisory. The information 
related to terrorist activity in the Middle East and to chatter from international 
intelligence sources. Intelligence was not specific to Utah and at the direction of 
Commissioner Flowers, followed the Utah Plan. The plan confirmed the state’s 
advisory at yellow, because the plan clearly identifies the threat shall be specific 
to Utah or the region surrounding the state. 21 

A confused media reported the bold move and with a general lack of 
understanding further confused the story communicating to a bewildered public. 
Other agencies and members of the private sector followed with simple questions 
of why didn’t the state change to the orange advisory. The education of the 
public was poor and the lack of understanding was evident throughout the nation 
and Utah was no exception. 

The response that followed was unexpected. There was not an 
understanding of the national system or the state system by the public or other 
agencies. The media interest on day one was reporting the Utah story like they 
would any other story, with one exception. They did not like the fact Utah was 
not following the nation. Following the plan was common sense. No specific 
threat, no need to panic and no waste of resources. Utah already had an 
Intelligence Fusion Center co-located with the FBI, if there was specific 
information we would have known about it. However, with the timing of the 
event, our efforts to educate other state agencies, federal and local agencies had 
fallen short. 

Other state and local agencies did not understand why the state was not 
following the national standard. Commission Flowers handled the press later the 
next day and the media was still confused over the yellow advisory. After 
explaining the HSAS and how it made sense for Utah, there was a slow reluctant 
change in philosophy. 


21 Utah Advisory System, Department of Public Safety, Robert Fowler, April 2002. 
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The conclusion of this experience was to follow the national system and 
not say anything specific about Utah. The bottom line meant Utah in fact was 
conducting daily routines that realistically fit in the orange advisory level and was 
the Department of Public Safety’s (DPS) status quo. To the public, yellow meant 
there was no need to panic or waste resources. 

There is a need to identify the standard for the state and assist local 
jurisdictions in developing their HSAS and supporting notification systems, 
protective measures and associated protocols. Planning, training and exercise 
for public safety, the general public, the private sector and volunteers will 
diminish the confusion and promote predictable actions. 

“We are working hard to enhance the Utah Homeland Security strategy 
with our public safety partners. Governor Walker is deeply committed to the 
efforts of improving our communication network, working on public relation 
campaigns, working closely with local and federal public safety agencies. DHS 
should communicate closer with the states; break down the level of 
communication to the regional level. If DHS had worked with the states and local 
entities in the beginning of the development of HSAS, there would never have 
been the confusion we experienced.” 22 

1. State Department of Health 

During the second increase to orange of the HSAS, in February 2002, 
Utah stayed at yellow according to the state plan; the Director of State Health 
was very confused why the state had stayed at yellow. He did not understand 
why the state would depart from the rest of the country. 

The expectation from other state agencies is to follow the state lead, 
which is in turn is to follow the national lead. The criteria were based on a 
reliable and imminent threat to the immediate area or state. 

Executive Director Rod Betit and Deputy Director Dr. Dick Melton had 
serious questions regarding the process of following the national advisory and 

22 Robert Flowers, Commissioner and Homeland Security Advisory, Utah Department of 
Public Safety, March 23, 2004. 
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the necessity of the state or local system. After analyzing the criteria and 
consequences of deploying protective measures each time, the Department of 
Health developed their own criteria and specific protective protocols for the State 
Department of Health and developed similar guidance for each of the health 
regions and hospitals. The criteria reflects the same specificity as the state 
HSAS.23 (See Appendix C) 

2. State of Utah Summary Points 

The State of Utah’s experience with the HSAS: 

• A high level of confusion and lack of definition specifically to the 
state agencies. 

• The state added definition to the national system by way of a 
customized Utah HSAS, which was recognized as a national best 
practice. 

It feels like we are preparing for the Olympics all over again, we just 
don’t know when they are coming. 

3. Salt Lake City 

Salt Lake City is the largest city in Utah with a population of 181,743, but 
is surrounded by tens of thousands of citizens concentrated in the Salt Lake 
valley. The city and the surrounding communities include manufacturing and 
industrial plants, refineries, and pipelines, large public gatherings similar to any 
large city or urban area in the United States. Many of the concerns of Homeland 
Security were echoed during the hosting of the 2002 Winter Olympic Games. 
What are the threats, vulnerabilities, and the risks? Dealing with these issues 
during the Winter Olympics was stressful, but was easier to define and place a 
boundary or fence around the venues. 

Homeland Security is very similar in comparison to the preparation 
for the Olympics; however you obviously can’t put a fence around it. 

When the threat advisory system was established no one in city 
government had any idea what the implications were for policy 
decision, notification procedures, protective measures and what 
does it mean to Salt Lake City? When the advisory was changed 
for the first time, we all heard it on the cable news networks. 24 

23 Dr. Dick Melton, Deputy Director, Utah Department of Health, March 2004. 

24 Mike Stever, Emergency Management Director, Salt Lake City, Utah, February 2004. 
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The Salt Lake City Mayor’s Chief of Staff called the State Emergency 
Management office to question the state’s notification system and purpose of the 
national advisory system. Questioning the affects on Utah? The confusion was 
statewide. Cable news networks were the form of notification. 

All local and state jurisdictions were asking the same questions looking for 
a reason to provide the necessary protective measures to their private and pubic 
assets. 

The issues of the general threats, the lack of specificity, notification, and 
the available resources all started to flow into complacency. Mike Stever, 
Emergency Manager for Salt Lake City believes from the city’s standpoint, the 
national system means next to nothing to us. 

The national system was so vague and ambiguous that it actually 
hurt the credibility of emergency management on the local level 
with our local officials. Elected officials, specifically the mayor 
wanted to know what the advisory system meant to the city. No 
one knew for sure, not the state nor the federal government. It 
seemed like we were making it up as we went. In general, 
Homeland Security has caused some procedures to be changed; 
generally relating to the airport, water, and police operations as well 
as general security. 25 

Salt Lake City’s concerns include the general nature of the advisory and 
believe the system should have never been called a “national system”. Mr. 
Stever continues, 

All alerts should be specific, the feds tell us the nation is on alert, 
but there is no threat to Utah or Salt Lake City. Are we or aren’t we 
at a high threat level? 

There are other threat and warning systems, for example, the military and 
the national weather service has a warning and advisory system. If there is a 
tornado warning in Oklahoma, should Utah take the same precautions? The 
HSAS should be as specific as the weather warning system. 26 


25 Ibid. 

26 Robert Fowler, State Bureau of Emergency Medical Services, Utah Department of Health, 
February 2004. 
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The city relies on the state to provide adequate notification from the 
Department of Homeland Security, but currently the proficiency of 
the notification system is poor. Because of the poor performance of 
the state’s notification system, there is very little reliance at this 
point. Salt Lake City is counting on the state to improve its 
notification systems. 27 

The frustration of playing to and supporting each threat in the 
jurisdictions and the state are in a catch 22. The City has to be 
prepared, but nothing happens; you fight the politics, or something 
happens and you should have been prepared and fight the politics. 

Mr. Stever compares the preparation similar to Y2K. There is a lot of time 
and energy spent on resources in continuity of government and business, and 
then nothing happens. The speculation is, why did we waste all the resources for 
nothing? It is the old emergency management quandary; of preparing for 
something we hope never happens. 

4. Salt Lake City Summary Points 

Salt Lake City’s experience with the national HSAS: 

• Confusion and lack of understanding of the system 

• Lack of direction from the state and from the Office of Homeland 
Security 

• Relied on the state for notification of the elevated advisory to 
orange, but heard it on CNN instead. 

• Salt Lake City developed a HSAS plan for the city that identifies the 
command structure and what specific decisions to make for 
notification procedures. The city has developed a HSAS that 
includes the federal system, but also includes a more specific 
criteria identifying when the city HSAS should be raised and 
lowered based on specific threat or intelligence. 28 

5. Washington County (Southern Utah) 

Dean Cox, Emergency Services Director for Washington County. 
Washington County is the fastest growing area in southern Utah and is a good 
sample of rural Utah. Mr. Cox said 


27 Mike Stever, Emergency Management Director, Salt Lake City, Utah, February 2004. 

28 Salt Lake City, Homeland Security Advisory System, Mike Stever, Salt Lake City, Utah, 
February 2004. 
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we don’t’ pay any attention to the national HSAS. I look at the 
HSAS and I inherently see a public relations/awareness tool much 
more so than a meaningful tool for responders at any level: 
Federal, State, tribal, or local. 29 

A plan exists with a list of standard operation procedures for 
protective measures to be taken for critical infrastructure protection 
and security. The criteria used are not significant until there is 
considerable evidence something is going to happen in the county. 

The HSAS consists of one page in our plan. 

Of course the HSAS’s largest problem, in my mind is neither the 
bias nor the coarseness, but the fact that it does not reflect a 
quantifiable measure of national risk. Its value to local 
governmental jurisdictions is virtually nothing without corroborating 
intelligence that will define the nature of an appropriate response. I 
feel that the HSAS has always been more politically valuable than 
of practical significance. 30 

6. Washington County Summary Points 

• They don’t pay attention to the national HSAS 

• The HSAS is a PR tool not a response tool 

• Need corroborating intelligence to add value to the system 

7. Northern Utah/Weber County 

Lance Peterson is the emergency manager for Weber County and co¬ 
chair of the Northern Utah Homeland Security Coalition (Northern Coalition). 31 
This area was a good sample of multi-urban jurisdiction of Utah. The committee 
is made of public safety representatives from the neighboring five county area of 
northern Utah. The purpose of the committee is to build cooperative partnerships 
for response, intelligence, investigations, health, volunteers, security, prevention 
and deterrence, an all-hazards approach for imminent threats. 

The first time the HSAS was raised, no one understood what it 
meant. No one had briefed us on it, so there was a lot of confusion. 

There was concern this was a national system to be used for 


29 Dean Cox, Emergency Services Director, Washington County, Utah, March 11,2004. 

30 Ibid. 

31 Northern Utah Homeland Security Coalition is formed from five contiguous counties in 
northern Utah. This group matured during the 2002 Winter Olympic Games and have continued 
since 9/11 and evolved into the model multi-agency committee for Homeland Security in Utah. 
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political purposes. In other words, the jurisdiction must change 

colors for the purpose of supporting the President, instead of using 

the HSAS for practical purposes. 32 

The leaders of the Northern Coalition identified the problems with the 
HSAS shortly after it was released in March 2002. By the summer, the coalition 
had made the necessary changes in the criteria to reflect a more specific system. 
The criteria are detailed in a plan, which describes the procedures to follow 
relying on intelligence from the Joint Terrorism Task Force. The JTTF shares a 
familiar message: if there were anything going on in Utah you would know about 
it because we would tell you. 

The expectation from the local jurisdictions is for notification to come from 
the Department of Homeland Security to the state and from the state to the local 
jurisdictions. Each time there is an increase in the HSAS, there is a responsibility 
from the state to local jurisdictions to clarify what the meaning is for the state. 

8. Northern Utah/Weber County Summary Points 

• Lack of understanding what the HSAS meant 

• Purpose of the system was to support the President 

• Customized their own HSAS 

• Heavy reliance on the JTTF for intelligence 

• Expect notification to come from the state 
B. NEW YORK CITY 

New York City is unique to the rest of the United States with the exception 
of the Washington D.C. area. September 11 th severely influenced the way police 
and fire, public works and other city services functioned forever in the city. 

The Police Department had its own alert system prior to September 11 th . 
This four level system included alpha (no threat) to omega (something has 
happened or is imminent) was active and supported by detailed plans for 
protection and response. 


32 Lance Peterson, Weber County Emergency Manager, March 8, 2004. 
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The adjustment to the national system was minor. It caused us to 
re-evaluate every element of threat, risk and vulnerability in the 
city. 33 

New York City has been at omega since September 11 th and at orange 
since March 2002 when the new system was announced. 

The protocols within NYPD have been identified at each level and there 
are specific directions for each commander to follow to meet the threat. There 
are flexibilities built into the protocol book to deal specially with a specific threat 
or event. 

The federal HSAS has orange; we have different shades of orange 
depending what is going on. For example, we have been at 
omega/orange since 9/11; if we receive specific intelligence 
pointing at the city, we will go to a bright orange. 34 

Intelligence is critical to responding appropriately to the threat. 

There are 146 detectives assigned to the Federal Bureau of 
Investigations New York office. If we need to know, we will find out. 

There are also a number of detectives assigned over seas to work 
directly with federal agents, so we are right in the middle of 
developing intelligence. We are in the direct line of communication. 

We cannot afford anything less. 35 

Chief Colgan believes the cities continuous orange alert adds to the 
prevention and deterrence of terrorism because of the high level presence of 
uniformed officers, National Guard troops, and the use of monitors, detection 
devices, surveillance and the high quality of intelligence. The Chief is very 
concerned that federal funds continue to be distributed throughout the country 
without consideration for the highest threat, risk or vulnerability. Changes have 
to be made in order to provide the proper protection to the city. The funding 
system should be risk based and threat sensitive. 36 


33 Deputy Chief John Colgan, New York City Police Department, Counter Terrorism Task 
Force, March 2004. 

34 Ibid. 

35 Ibid. 

36 Ibid. 
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The Fire Department of New York City also has a similar HSAS system. 
There are three levels; orange, bright orange and red. At each level there are 
specific protocols to follow based on the threat. FDNY has also been at orange 
since September 11 th and relies on intelligence and notification from NYPD. 37 
There is enough flexibility in the protocols to focus on specific threats. 

1. New York City Summary Points 

• They had a similar system for years and the conversion was a 
minor adjustment 

• They have been at omega or orange since September 11 th 

• The system revision caused the city to rethink their vulnerabilities 

• The City system defines specific protocols to be followed, but 
enough flexibility to focus on specific security or protection areas. 

• They are proactive with intelligence and do not rely solely on the 
FBI and the JTTF. 

C. CONCLUSION 

Each jurisdiction at the state or local level including the largest 
metropolitan city in the country has struggled with defining what influence the 
national HSAS has on their area of practice. New York City already had a similar 
system with specific protocols to follow and the adjustment was easy. 

The State of Utah and local governments did not have a comparable 
system nor was there an understanding of what a national system meant to the 
state. However, common sense prevailed and each jurisdiction developed a 
HSAS specific to their needs. In each case, the system added specificity and 
clarity to the public safety community. 

Public awareness or public relations was absent in all cases. In New 
York, there was not a cause of fear or misunderstanding of the HSAS because 
the city had already survived September 11 th and it would take a lot more than a 
new HSAS to concern the citizens. 


37 Mike Weinlein, Deputy Chief, Fire Department of New York, December 2003. 
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Utah is another case and I would argue most of the rest of the nation was 
in a similar situation as Utah, confused. The failure is not that the HSAS is a bad 
idea, but that DHS did not involve state, local and private sector stakeholders in 
the process. DHS let the system stand on its own. There was no education of 
the public, no education for public safety or the private sector. 

The HSAS system would have been easily developed and implemented if: 

• DHS had consulted with state and local Homeland Security officials 
and the public sector to help identify and solve key issues and 
specifically to help deal with the issues of warning and notification. 

• DHS had implemented a full media strategy, educating the public 
developing and delivering a full range of public relation tools, for 
example posters, PSAs, refrigerator magnets, brochures, training of 
volunteers, etc. 

• Provided templates to all state and local public safety agencies to 
allow customization of the HSAS system and specific protective 
measures to fit individual jurisdictions 

• Provided templates for HSAS, protective measures and training to 
the private sector. 

• Guaranteed a seamless sharing of information intelligence network 
to provide specificity to federal, state and local public safety 
agencies. 

If these strategies had been delivered in the beginning, there wouldn’t be 
the confusion now. 
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IV. SUMMARY AND RECOMMENDATIONS 


This chapter summarizes the case studies from the previous chapter and 
makes recommendations for improvement of the Homeland Security Advisory 
System. Based on current documentation, the conclusion will be that the HSAS 
has problems; however, these problems can be fixed. During the last alert in 
December 2003 and January 2004, more specific threat analysis was provided. 
Recently, Secretary Ridge said,” We don’t have to raise the threat advisory to 
increase our security.” 38 

A. DOMESTIC CASE STUDY ANALYSIS 

The domestic case studies revealed several consistencies; 1) in the first 
four alerts DHS and intelligence sources lacked specific threat or location 
information, 2) public safety agencies and the public don’t pay attention to the 
national system, 3) each public safety agency will provide the necessary level of 
protection and response regardless of the HSAS based on the intelligence they 
receive, and 4) the lack of public understanding and involvement. 

And Lets Remember That Those Charged With Protecting Us From 
Attack Have To Be Right 100% Of The Time. To Inflict Devastation 
On A Massive Scale, The Terrorists Only Have To Succeed 
Once. 39 

B. THE HOMELAND SECURITY ADVISORY SYSTEM DEPENDS ON 
SPECIFIC INTELLIGENCE 

The lack of specific intelligence and information relating to the warning 
caused ambiguity, which lead to confusion of the purpose of the HSAS. The 
nation quickly recognized that most of the nation was being alerted to an 
unknown threat. 

The most important component to an effective HSAS is specificity. It does 
not matter if the HSAS is national, regional or local, specificity will allow direct 


38 
2004. 

39 


Secretary Tom Ridge, Department of Homeland Security, NBC, Today Show, May 26, 
National Security Advisor, Dr. Condoliezza Rice, April 8, 2004. 
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timely applications to prevent, deter or mitigate terrorism. There has to be 
specificity in the type of target, the method of attack, the specific location of the 
attack or the suspects. 

On the last change in the advisory, December 21,2003, DHS attempted to 
be more specific in their warning, identifying the use of aerial assets to attack and 
the likely locations to launch an attack. There were targets also identified such 
as Washington DC, nuclear plants and other assets located in proximity of the 
target areas. DHS officials delayed and cancelled international flights from 
Europe, based on the passenger lists and the destination of the flight. 

These are improvements in the accuracy of the information but the 
timeliness remains to be seen. There are criticisms with regards to the flight 
delays accusing DHS of speculation on the intelligence and there is nothing 
specific. The liability of having to know everything all the time and act 
accordingly is a heavy weight to bear, but is necessary during the war on 
terrorism. Imagine the repercussions, if an action was not taken in response to 
specific intelligence. The 9-11 commission investigated this very example. The 
expectations are we should have known better. 

How long before decisions to the let the plane fly or the tanker to enter the 
harbor, or to allow a border crossing have an economic bearing on the decision 
making process. In all business affairs the bottom line is money. These 
decisions may have a short-term effect on industry and perhaps the national 
economy. This seems to be another sign of complacency or denial when the 
priorities change back to normal business activities. 

Laws don’t prohibit the sharing of information, cultural blocks do 40 

C. TIMELY, ACCURATE AND USEABLE INTELLIGENCE 

Current domestic and international intelligence systems are not designed 
to provide information specific enough to be of value to the local and state 
agencies. The nature of the intelligence to date has been vague at best. 

40 Tom Wingfield, Lecture, Naval Postgraduate School, Monterey, California, December 
2003. 
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Notifications of threats to bridges, or to airports are too general and not specific 
enough. Federal, state and local officials have requested more specific threat 
information to assist in determining the protective measures to be deployed. 
Information should be specific enough to break down into region, sector, site or 
event. This would also allow for a more efficient allocation of resources to a 
specific area instead of protecting the entire area of responsibility. 41 Recent 
attempts have been made to narrow the focus which is improving each time. 

Specific threats to New York City are provided in briefs that the rest of the 
country will never know about because of the nature of the intelligence (need to 
know), but yet critical enough for the entire country to rise to orange. This does 
not make sense; we must set a higher level of expectation. 

In May 2003, the Terrorist Threat Integration Center (TTIC) was unveiled 
as the nation’s fusion center for domestic intelligence. 42 This fusion center is 
located at CIA Headquarters and is responsible for the collection and analysis of 
intelligence. The intelligence community (1C) players include Department of 
Defense (DOD), United States Secret Service (USSS), Director of Central 
Intelligence (DCI), US Coast Guard, Bureau of Intelligence and Research (INR), 
Nuclear Intelligence (NUCINT), National Security Agency (NSA), National 
Geospatial-intelligence Agency (NGA), National Reconnaissance Office (NRO), 
Defense Intelligence Agency (DIA), state and local intelligence offices. 43 

The TTIC is an attempt to fuse the nation’s intelligence, which has to 
happen. At the same time, the nation needs the ability to network horizontally 
and vertically to open sourced intelligence data. Analysts need access to data 
and secure points of contact necessary to provide analysis to their jurisdiction. 


41 Risk Communication Principles May Assist in Refinement of the Homeland Security 
Advisory System, Government Accounting Office Report, Homeland Security, March 2004. 

42 Shane Harris, “CIA Opens New Terrorism Intelligence Center,” Government Executive 
Magazine, May 1,2003. This article explains the maturation of the TTIC with the main players 
coming from CIA and FBI and the centers location for now at CIA. The TTIC is separate from 
DHS, which is supposed to be responsive for intelligence for Homeland Security. 

43 Captain Robert Simeral, Naval Post Graduate School, Notes from Lecture, September 
2003. 
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The now famous August 6, 2001 briefing to the President was de¬ 
classified and made available to the public. The contents may be argued for 
years to come, however the classified document whether historic or not, alone 
may have meant very little. What if that briefing would have been cleansed and 
posted on the secure websites. Collectively in a TTIC or other multi-agency 
fusion center, included with all other intelligence, might have predicted a different 
outcome. 

DHS gathers and analyzes information from the 1C and determines the 
threat potential. IAIP makes the recommendations to the Secretary if the threat 
advisory should be elevated. Staff further analyzes the timeliness of the data 
and whether the protective measures at orange are enough to counter the threat. 
DHS admits the system is subjective and the more specific criteria have not been 
developed. 44 

D. INTELLIGENCE ANALYSTS 

It is vital to have local agencies involved in gathering and sharing 
intelligence from the local and state agencies. There are more state and local 
eyes than federal eyes; therefore, it is important to share seamlessly horizontally 
and vertically. 45 Public safety agencies lack the intelligence gathering skills to do 
the job. These agencies are restricted by budget, personnel, and the proper 
training. Each state and local agency has to commit to the resources necessary 
to fulfill the intelligence mission. 

Captain Mitch McKee of the Utah Criminal Intelligence Center states the 
challenge with hiring good analysts is finding quality personnel, paying a 
competitive salary and providing high quality training. Typically analysts are re¬ 
assigned from other law enforcement (LE) duties and don’t have specific skills 
relating to 


44 Homeland Security Advisory System: Preliminary Observations Regarding Threat Level 
Increases from Yellow to Orange, Government Accounting Office, Report to the House Select 
committee on Homeland Security, February 26, 2004. 

45 Robert L. Flowers, Commissioner and Homeland Security Advisory, Utah Department of 
Public Safety, March 2004. 
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intelligence and analyst work. Budgets are extremely tight and once an analyst 
is trained they move to another job because of higher pay. Analyst training is 
available from the federal government and from the private sector. 46 

Sgt. John Sullivan, from the Los Angeles County Sheriffs Office and the 
Terrorist Early Warning group (TEW), is concerned intelligence analysts do not 
receive the necessary training to conduct in depth analysis. 47 There should be a 
formalized professional training certification to bring a higher standard to 
analysts. Analysts are not analysts by primary assignment; it is a very technical 
field and requires extensive training and years of experience and dedication. 
This is a problem in the intelligence world. 

A By-product of the 2002 Winter Olympic games 

E. STATE INTELLIGENCE FUSION CENTERS 

A state fusion center is a place where critical information is collected 
analyzed and disseminated to local, state and federal LE agencies. Traditionally, 
there is not a recognized organization of intelligence at the state level. In fact in 
most state, local and federal law enforcement criminal and intelligence 
structures, there is a cultural block of protection. The state and local law 
enforcement agencies do not have a formal way to filter and analyze information. 
In most cases, the information is fragmented and not networked. LE has done a 
great job of collecting information, but has done a poor job of analyzing and 
disseminating the intelligence. 48 The intelligence function is a new concept to 
the local and state law enforcement entities. 

At the minimum, each state needs an intelligence fusion center with 
collaborative representation by multiple local law enforcement jurisdictions. Their 
purpose is to aid all local jurisdictions in filtering and analyzing the thousands of 
pieces of information they collect. The center should also function as a feeding 

46 Captain Mitch McKee, Utah Criminal Intelligence Center, Utah Department of Public 
Safety, March 2004. 

47 Sgt John Sullivan interview September 2003, Monterey, California; John had his analysts 
attend FBI and CIA analyst training, which to his knowledge is the best around. But is it enough? 

48 Captain Mitch McKee, Utah Criminal Intelligence Center, Utah Department of Public 
Safety, March 2004. 
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point to the Joint Terrorism Task Force (JTTF). 49 The JTTF and the state fusion 
center should be co-located to aid in building trust and information sharing 
capability. The idea of the co-location is about building relationships face to face 
with other local, state and federal analysts and the FBI. There are various levels 
of success at each JTTF. In Utah, the system is working very well. The 
connection between the JTTF and the TTIC is paramount to bringing the level of 
international and domestic terrorism intelligence to the local level and vice versa. 
The JTTF should feed the intelligence to the TTIC and should also receive 
needed intelligence for dissemination to state and local jurisdictions. All 
intelligence should flow up and down within the system. 

There are many traditional intelligence barriers that should be rebuilt. The 
TTIC may be the start of a new system, if they relocate to a neutral location and 
start a new culture and include all the 1C players under the direction of DHS. It 
would be easier to start a new culture with new agents rather than wasting time 
with the old agents representing old traditions trying to change them. 

The Gilmore Commission in their last report recommends the 
establishment of the TTIC as an independent agency with permanent staff with 
representatives from state and local government. 50 The report references the 
development of an Ml 5-type domestic counter terrorism intelligence agency with 
the primary purpose of preventing terrorism. This idea was not very well 
received at the White House. 51 


49 Robert A. Martin, “The Joint Terrorism Task Force a Concept that Works,” Law 
Enforcement Agency Resource Network, 2002; The JTTF has two objectives; reactive: to 
respond to and investigate terrorist incidents or terrorist-related criminal activity; and proactive: to 
investigate domestic and foreign terrorist groups and individuals targeting or operating in the state 
for the purpose of detecting, preventing, and prosecuting their criminal activity. 

50 Gilmore Commission Report, December 2003. 

51 Ml 5 is a British security intelligence agency. Their purpose is to protect national security 
and economic well-being and to support the law enforcement agencies in preventing and 
detecting serious crime. MI5 is responsible for security intelligence work against covertly 
organized threats to the nation including terrorism, espionage and weapons of mass destruction. 
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The number of state intelligence fusion centers may vary depending on 
population density and level of threat. However, the point remains there has to 
be a state and local intelligence structure for collection, analysis and 
dissemination. 

The prevention and deterrence of terrorism around the world depends on 
timely and accurate intelligence. If immediate changes are not demanded in 
culture and systems, people will continue to rely on gut instincts for policy 
making. The specificity for the HSAS and the efficiency of the warning will 
continue to be broad and the system will soon die with the loss of credibility. 

There are several working models of State Fusion Centers from which to 
choose, for example, the Georgia Information Sharing and Analysis Center 
(GISAC), Utah Criminal Intelligence Center (UCIC) and the North Dakota 
Intelligence Fusion Center. The intelligence centers serve different populations 
and each reach out to federal and local sources and compress data and 
disseminate intelligence. 

The GISAC was formed following September 11 th through the Georgia 
Homeland Security Task Force. The mission of GISAC is to serve as the focal 
point for the collection, assessment, analysis and dissemination of terrorism 
intelligence information. GISAC works with the FBI in the collection and 
dissemination of local and state intelligence information. 

The staff includes seventeen agents from state Homeland Security office 
and task force, bureau of investigations, emergency management, the National 
Guard, sheriffs association, police chiefs association. Other members include 
the FBI, DHS and the JTTF. 52 

The Utah Criminal Intelligence Center (UCIC) is a by-product of the 2002 
Winter Olympic Games and is formatted very similar to Georgia. The level of 
participation includes members from several divisions within the Department of 
Public Safety, the Department of Corrections, and the Utah Law Enforcement 

52 The Georgia Information Sharing and Analysis Center Project, Georgia Homeland Security 
Task Force, Charlie English, Director of Operations, Georgia Emergency Management Agency, 
April 2004. 
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Information Network and other members from local LE agencies. The total staff 
is 26. UCIC is co-located with the FBI and they work very closely with the 
JTTF.53 

The North Dakota Intelligence Fusion Center was also developed shortly 
after September 11 th determining the need to collaborate on state intelligence 
issues. Although the center is smaller the Utah’s and Georgia’s, it performs the 
same function of collecting, analyzing and disseminating intelligence horizontally 
and vertically throughout the state. 

Three different states determined the need within their state jurisdictions 
and recognized information sharing and intelligence gaps between local, state 
and federal LE agencies and took on the responsibilities and developed fusion 
centers to function in this capacity. Each state felt it was important to also 
involve the FBI and JTTF in their organizations. Fusion center seems to be a 
consistent theme throughout the country and states are taking the lead and 
prioritizing the resources to become operational. 

New York City determined the need to be much greater than a fusion 
center for the city. Their intelligence center includes agents assigned in different 
locations around the world gathering intelligence first hand. Instead of trusting 
the federal government to share intelligence, New York City is in the trenches 
working on the front line. 

We heard it on CNN 

F. TIMELY ACCURATE NOTIFICATION SYSTEM 

Once the 1C has established the national intelligence network there has to 
be a system of notification. The purpose is to notify the proper entities within the 
state of the threat. In the past, notifications of the warnings have come from the 
cable news networks; in fact it’s a joke. This has been very frustrating to many 
state and local agencies: this has resulted in the loss of credibility for state and 
federal agencies. Homeland Security agencies appeared ineffective to the public 

53 Captain Mitch McKee, Utah Criminal Intelligence Center, Utah Department of Public 
Safety, March 2004. 
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and other entities because without notification of the alert change, these 
agencies do not have time to prepared proper responses. 54 This is not 
acceptable; a broader more robust local, state and federal system must be 
established. 

Today the DHS has improved, however it is standard practice for agencies 
to monitor cable news just in case. The DHS still has not formalized protocols for 
notification. New notification processes have been implemented, for example; 

• Conference calls between DHS and the Governor’s and their 
Homeland Security Advisors 

• Telephone calls from DHS to federal agencies 

• E-mails and phone calls from Homeland Security operation center 
(HSOC) 

• HSOC utilizing electronic systems such as the Joint Regional 
Information Exchange (JRIES) 

• National Law Enforcement Telecommunications System (NLETS); 
and 

• Email or telephone communications with federal agencies and their 
chief of staff and other key staffers 55 

Technology is available to deliver the proper notification in a very prompt 
circumstance. The use of pagers, text messaging, email, fax, the old fashion 
telephone are all available now in a standard or wireless environment and can 
incorporated in a elaborate nationwide alert network. It is too easy to create a 
one-button activation system. Again, it is just a matter of technology to make it 
happen. 

The DHS should stop providing media notifications of pending news 
conferences to minimize the speculation of the advisory change before it 
happens. This would allow the DHS to communicate in a timely manner with 
state and local Homeland Security officials. 

There is enough flexibility in the system to target regions or 

sectors 56 

54 Risk Communication Principles May Assist in Refinement of the Homeland Security 
Advisory System, Government Accounting Office Report, Homeland Security, March 2004. 

55 Ibid. 
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G. SPECIFIC AND EFFECTIVE PROTECTIVE MEASURES 

Protective measures are those steps taken to protect or secure critical 
infrastructure. Protective measures are implemented when the advisory level 
changes. The measures are easily incorporated into local plans; the challenge is 
to determine which protective measures to implement based on the intelligence, 
instead of all of them. Specificity of intelligence is critical to minimizing the 
challenge of protecting everything. 

Protective measures can range from restricted parking near a building to 
increasing physical security of a power substation. This depends upon the 
vulnerability assessments that have been conducted for each community and 
state critical infrastructure. 

The following suggested protective measures come from DHS and 
recommend basic guidance at each level from yellow to red. 

H. FEDERAL RECOMMENDATIONS 

1. Yellow 

• Increasing surveillance of critical locations; 

• Coordinating emergency plans as appropriate with nearby 
jurisdictions; 

• Assessing whether the precise characteristics of the threat require 
the further refinement of preplanned Protective Measures; and 

• Implementing, as appropriate, contingency and emergency 
response plans 

2. Orange 

• Coordinating necessary security efforts with Federal, State, and 

local law enforcement agencies or any National Guard or other 
appropriate armed forces organizations; 

• Taking additional precautions at public events and possibly 
considering alternative venues or even cancellation; 

• Preparing to execute contingency procedures, such as moving to 
an alternate site or dispersing their workforce; and 

• Restricting threatened facility access to essential personnel only 

56 Chris Strohm, “Homeland Security May Alter Threat Advisory System,” quote from 
Secretary Tom Ridge, Government Executive Magazine, January 9, 2004. 

38 



3. Red 

• Increasing or redirecting personnel to address critical emergency 
needs; 

• Assigning emergency response personnel and pre-positioning and 
mobilizing specially trained teams or resources; 

• Monitoring, redirecting, or constraining transportation systems; and 

• Closing public and government facilities. 57 

At each level, the additional protective measures are compounded to the 
next level. 

I. STATE RECOMMENDATIONS 

The Utah Department of Health customized a Homeland Security Advisory 
System for their agency. The agency includes Utah Public Health and Medical 
Systems and they divided the protective measures into five areas; Public affairs, 
epidemiology and surveillance, notifications and surveillance, notifications and 
communications, preparedness and response and general security provisions. 
At each level of the Health HSAS there are specific actions to be taken. (See 
Appendix C) 

For example, in epidemiology and surveillance, under a red advisory, the 
recommendations and considerations are: 

• Conduct epidemiologic investigation; coordinate with law 

enforcement, Utah Department of Health, FBI as needed 

• Activate enhanced surveillance protocol and monitor community 
indicators 

• Establish public health surveillance for potential toxic exposures 
following an emergency 

• Determine need for isolation or quarantine measures and activate 
protocol if needed 

• Coordinate veterinary risk assessment-investigation-control 

measures 

• Report clusters of illness, health syndromes and trends to the Utah 
Department of Health, Office of Epidemiology 58 

57 Department of Homeland Security, Homeland Security Advisory System, Suggested 
protective measures, April 2004. 

58 Utah Public Health and Medical Systems, Homeland Security Threat Conditions Protocol, 
Utah Department of Health, Robert Fowler, 2004. 
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These are small samples of protective measures that should be 
customized to each specific infrastructure, agency, community and state entity 
linked to the HSAS. Protective measures can be determined based on 
vulnerability assessments measured against threat and risk. 

J. A PROACTIVE PUBLIC RELATIONS, EDUCATION AND VOLUNTEER 

CAMPAIGN WILL ENGAGE THE PUBLIC 

1. Media 

We all witnessed the fall of the twin towers and the Pentagon burning on 
September 11 th ; we felt the fear of uncertainty. The United States had never 
witnessed an attack before, shock, dismay and disbelieve was a common 
reaction. The influence of the media can tell a compelling story and present the 
facts in a responsible manner and that can be the difference between calm and 
panic. The media can turn 180 degrees with the power and the influence and 
speculate the facts and cause undue panic and harm. 

The media can be used in a positive manner prior to an event to educate 
and train the public about the different types of events. The use of public service 
announcements, specific alerts and actions to be taken can all be communicated 
on the mediums we already utilized everyday. 

The same is true for the reporting of any story that reflects a catastrophic 
event whether human caused or natural disasters. Media is very influential 
whether it is newspaper or its television. The old saying, “if it bleeds, it leads” is 
true, but does this cause more outrage or does it calm and educate? The media 
can manipulate information in order to increase ratings; however this cannot be 
done in a time of crisis. Reflection on the media coverage of September 11 th 
overall was handled very well. 

Hugh Wyatt suggests that the media should take more responsibility for 
the broadcasts during times of crisis. The broadcasts of false, misleading or the 
interview by a so-called expert may have psychological affects on the viewers 
and or the listeners. 
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Wyatt continues with several practical strategies for determining scenario- 
based messages ahead of any actual event. Planning ahead would include 
partnering with well-respected recognizable media talents to assist in delivering a 
factual message that is believable. 59 

Develop plans with media organizations and agree upon a set of rules 
dealing the specifics during a catastrophic event. This will improve the quality of 
the message and reduce the amount of fear imposed by a poor news story. 

The media strategy can include a public relations campaign to protect the 
extreme protective measures taken and detail the work of the state, local and 
federal intelligence agencies. We can use the art of deception to show what is 
being done on the ground. The message would be specifically designed for 
terrorist that might be watching. This could be another tool for prevention and 
deterrence of terrorism. Deception has been used in previous wars very 
effectively. Instead what we see is the under cover reporter walking in the open 
gate at a chemical plant attempting to show all of our vulnerabilities. The media 
wants to expose us instead of protect us. 

Another planned component mention early as being a challenge, can be 
changed into an asset. I talked about the media always notifying the public of an 
alert change before the state and local Homeland Security Advisors were 
notified. Ordain the media as one of the official sources of notification. Utilize 
the private sector connectivity and integration to the advantage. If you can’t beat 
them, join them. 

2. Public Awareness 

The basis for the misunderstandings and the gaps of the Homeland 
Security Advisory System evolve around poor public relations information. The 
big problem was the broad misinterpretation by public safety, the general public 
and the private sector. 


59 Hugh W. Wyatt, The Role and Responsibility of the Media in the Event of a Bioterrorist 
Act, J Public Health Management Practice, Aspen Publishers, Inc., pp. 63-67. 
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Not one entity understood the HSAS when it was first released and they 
didn’t understand during the initial elevation of the threat levels. A public 
awareness campaign did not inform all public safety entities about HSAS. There 
were no specific actions, how to implement, no training, no planning, no 
exercises, and no funding. 

Currently, a large portion of the public no longer pays attention to the 
HSAS. For example, New York City has been at orange for almost two years. 
Complacency has replaced confusion because the general public has all but 
given up on understanding the system. What can be done to minimize the 
negative reaction of fear and encourage a positive reaction of calm and 
response? If terrorism is designed to cause fear, then we must find a way to 
increase the information flow and educate the public to diminish or mitigate the 
fear factor. A lot can be done in the training of volunteers and educating the 
general public about the HSAS and to encourage involvement through 
volunteerism. 

Best practices can be learned from the Israelis through their public 
involved programs implemented during 55 years of terrorism. The Israelis 
engaged in an extensive cooperative effort between the police, security agencies 
and the public. 60 The United States needs a new culture and a public strategy to 
win the war on terrorism. Our goals should be similar to those of Israel: 

• Prevent terrorism and minimize damage 

• Prevent public panic and extreme reactions 

• Channel the public to act productively 

We have to get the public educated, involved and increase the awareness 
of terrorism. Training should include: preparedness, motivation, security 
measures prior to an attack, reactive behavior to a threat advisory or an attack, 
how to communicate and emergency planning and exercise, etc. 


60 Reference Appendix D for more details on the Israelis strategy for fighting terrorism. 

42 



There are many volunteer organizations across the nation, which have 
been established for many years and have served honorably in many different 
capacities. The American Red Cross, Community Emergency Response Teams, 
Volunteers in Police Service, Medical Reserve Corp, Volunteer Organizations 
Active In Disasters, Neighborhood Watch, Search and Rescue Organizations, 
Americorps, Citizen Corp and many more. 

These organizations have already established the foundation by which the 
pubic as well as the public safety and the private sector can utilize. However, the 
next step should be taken to enhance their skills through additional training to 
include Homeland Security elements. Employ those skills on a regular basis 
through planning and exercises. There is always a citizen’s organization to 
participate actively in the crisis response. The challenge in America is 
complacency. Fighting terrorism on our soil is as important as the moment. 
Once the moment passes the opportunities for awareness, training and 
education has passed also. Other issues rise to the top. The United States does 
not have the weekly terrorist activity Israel has. If it did, U.S. citizens would be 
front and center. 

U.S. citizens have come a long way and the use of their eyes through 
vigilance has assisted in law enforcement and terrorist related activities and it is 
important to note that there are many more citizens than state and federal law 
enforcement officials. If the war on terrorism is brought to our streets through the 
use of a car bomb or suicide bombers, there would be more urgency and the 
focus to succeed. 

The Israeli police produce commercials on TV and utilize other mediums 
to enhance public awareness. The United States must do the same type of thing 
utilize the media better to inform and educate the public long before an event. 
The bottom line is terrorism in Israel is a concern to everyone and a high priority. 
They are determined to succeed and so should the United States. 
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A good public relations campaign utilizing the media when the Department 
of Homeland Security first unveiled the HSAS would have minimized the 
misunderstanding of the system, better utilized resources, and provided more 
efficient respond mechanisms. A prepared general public with full knowledge 
and understanding of advisory systems trained through community programs and 
the capability to respond will go a long way to assist public safety agencies. 

Our communities need to develop the same kind of intensity and resolve 
to not fall victim, but rise to the occasion and to do what has to be done to protect 
the homeland and defeat terrorism. 61 Knowledge has to inspire, not lure into 
complacency. Complacency leads to inactivity and non-participation. 


61 The Israel Experience in Homeland Security, Presentation and briefing at the National 
Emergency Management Association meetings Washington DC, February 2003, There are four 
points to the Israelis program and they are Public Awareness and Participation, Coordinating the 
Response Elements, Israel Defensive Force (IDF) Command and NBC Preparedness, Hospital 
Preparedness and the National Center for Medical Simulation. 
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V. CONCLUSIONS 


This chapter summarizes the recommendations for improvements to the 
HSAS, and concludes that a need exists for a State and Local Homeland 
Security Advisory System (SLHSAS). A SLHSAS is a customized version of the 
HSAS that will have specific triggers to specific protective measures to protect 
state and local assets. The (SLHSAS) can be activated along with the HSAS or 
separately by any appropriate agency using specific criteria. 

It is not possible to roll back the clock and prevent what happened on 
September 11 th . However, it is possible to prevent and deter future attacks on 
the domestic front. It is our job and our duty. 

The Department of Homeland Security implemented an advisory system 
primarily designed for the federal government to utilize. Today the HSAS is a 
system used to inform the public, the public safety community and the private 
sector. The five colored system did not work out as planned by DHS; confusion 
reined, billions in resources were expended, general warnings were issued, 
protective measures were applied and there was an overall sense of urgency 
nationwide. An advisory applied to New York City has a different value in Utah. 

A year ago, the HSAS was the subject of controversy and 
misunderstanding among local, state and federal officials. Since then there has 
been many articles, audits and research conducted analyzing the faults and 
failures of the HSAS. The Gilmore Commission, The Government Accounting 
Office, The Rand Corporation, The Markle Foundation, The Council of State 
Governments and many others have testified, researched and made 
recommendations regarding the HSAS. 

Many local and state jurisdictions have not waited for the federal 
government to render a new policy regarding the HSAS, they have determined 
with the use of common sense the need to develop a local HSAS system that 
details the specific nature of the threat, protective measures to implement and 
the response mechanisms to deal with terrorism. The entire system is dependent 
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on the variable of available intelligence and accurate warning systems. Without 
both, implementing or not implementing protective measures is a pure gamble. 


The ultimate outcome is to provide enough specific intelligence to the 
local, regional or state, and federal jurisdictions to allow executive decisions to be 
made based on vulnerability, threat and risk to protect citizens, critical 
infrastructures and other visible targets from terrorists. Homeland Security 
Advisory Systems should have the flexibility to raise and lower the color code 
based on specific information relating to each jurisdiction. For example, a local 
jurisdiction should have enough flexibility to elevate the HSAS without the rest of 
the country elevating. 

A. ELEMENTS OF AN EFFECTIVE HOMELAND SECURITY ADVISORY 

SYSTEM 

Below is a list of specific recommendations needed to develop an effective 
Homeland Security Advisory System. 

• Specific intelligence sources from international and domestic 
integrated intelligence systems. Intelligence narrowed down to the 
region, state or community. Information may refer to the entire 
region or just a specific infrastructure, for example pipelines or 
Embassies. Specificity allows for very specific actions to be taken 
in support of the Homeland Security. 

• The HSAS is dependent on timely accurate useable 
intelligence. The traditional intelligence barriers will never be 
broken down in time to prevent the next terrorist act. The 
result is information setting on a shelf or in a drawer or 
marked irrelevant, instead of sharing it on a multi-agency 
open sourced network. There is a need for a new culture in 
federal intelligence systems; it should have a new name in a 
new location under the direction of DHS. The purpose is to 
counter the old cultures of the FBI, CIA, USSS, NorthCom 
and others. 

• Intelligence work for state and local agencies is a complex 
assignment. Working in intelligence is not something 
assigned because of a disciplinary action or recovering from 
an injury. An intelligence analyst requires very technical 
training and years of experience and should be paid 
accordingly to keep the individual in the position. There is a 
high level of expectation. 
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• Each state or large metropolitan jurisdiction, similar to New York 
City and Los Angeles area should have a fusion center for 
intelligence. A localized fusion center is important because there 
should be a focal point where local intelligence can be fused with 
federal intelligence and dispersed to all jurisdictions. Connection to 
the federal TTIC and to local intelligence jurisdiction is critical to the 
sharing of information. Each center should be co-located with the 
JTTF’s to build trust and to enhance the flow of information sharing 
horizontally and vertically. Membership in the fusion centers should 
include a diversity of federal, state and local public safety agencies. 

• The HSAS should be adapted or customized to include specific 
protective measures when the threat information is localized. Each 
community, state government and the private sector should 
develop and exercise a State and Local Homeland Security 
Advisory System (SLHSAS) similar to the ones described in 
Appendices B or C. 

• A simple effective notification system should be implemented 
from the federal government to the state and down to the 
local jurisdictions. The system should have the flexibility to 
be activated from any jurisdiction. The nature of the 
notification should move from a joke to reality whether the 
existing cable news networks are directly apart of the 
solution or not. The technology is available to allow for one 
button activation for a nation wide system that provides 
accurate timely notification. 

• Finally, a comprehensive proactive public understanding of what 
the advisory system means national and locally. The public should 
be well educated through the media public service announcements, 
volunteer training, school and work awareness programs to 
enhance the knowledge base, the response capabilities and the 
continuity of business. If the citizens know what is going on during 
any pre or post disaster scenario, the community’s ability to deal 
with the human caused or natural disasters is increased and the 
psychological impact of fear is decreased. This will allow the 
recovery progression to move forward and begin the healing 
process and the return to normalcy as soon as possible. 

The public, pubic safety agencies and the private sector have all 
experienced the wave of confusion from the HSAS. Since the unveiling of the 
HSAS in March 2002, several common themes have emerged; what does this 
mean to my agency, my community, my business or what does it mean to me. 
The maturing process of the advisory system has solved some of the issues. 
Each public safety agency will provide the necessary level of protection and 
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response regardless of the HSAS based on the intelligence they receive. The 
private sector is going to build redundancy in their business to stay in business or 
shorten the recovery time. The general pubic still looks to the government for 
support and guidance during times of crisis. The element of fear management 
and the reduction of psychological impacts are reduced with the involvement of 
the pubic. There is a sense of purpose and belonging to a volunteer group who 
identifies with a specific mission. The level of training and exercises eases 
anxiety and enables the volunteer to participate, function and contribute to the 
cause. 

The Homeland Security Advisory System is a part of larger Homeland 
Security strategy for the nation to prevent, deter, respond and recover from a 
terrorist act. It is an example of the collaborative culture we must promulgate 
around the country in all jurisdictions. We must share, communicate, and we 
must involve our citizens, our public safety agencies, and the private sector in a 
comprehensive strategy for providing a safer homeland. 
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APPENDIX A. HOMELAND SECURITY ADVISORY SYSTEM 


Understanding the Homeland Security Advisory System 

Guidance for Federal Departments and Agencies 

The following Threat Conditions each represent an 
increasing risk of terrorist attacks. Beneath each Threat 
Condition are some suggested Protective Measures, 
recognizing that the heads of Federal departments and 
agencies are responsible for developing and implementing 
appropriate agency-specific Protective Measures: 

1. Low Condition (Green). This condition is declared 

when there is a low risk of terrorist attacks. Federal 
departments and agencies should consider the following 
general measures in addition to the agency-specific 
Protective Measures they develop and implement: Homeland Security 

Advisory System 

• Refining and exercising as appropriate preplanned Protective 
Measures; 

• Ensuring personnel receive proper training on the Homeland 
Security Advisory System and specific preplanned department or 
agency Protective Measures; and 

• Institutionalizing a process to assure that all facilities and regulated 
sectors are regularly assessed for vulnerabilities to terrorist attacks, 
and all reasonable measures are taken to mitigate these 
vulnerabilities. 

2. Guarded Condition (Blue). This condition is declared when there is a 
general risk of terrorist attacks. In addition to the Protective Measures taken in 
the previous Threat Condition, Federal departments and agencies should 
consider the following general measures in addition to the agency-specific 
Protective Measures that they will develop and implement: 

• Checking communications with designated emergency response or 
command locations; 

• Reviewing and updating emergency response procedures; and 

• Providing the public with any information that would strengthen its 
ability to act appropriately. 

3. Elevated Condition (Yellow). An Elevated Condition is declared when 
there is a significant risk of terrorist attacks. In addition to the Protective 
Measures taken in the previous Threat Conditions, Federal departments and 
agencies should consider the following general measures in addition to the 
Protective Measures that they will develop and implement: 
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• Increasing surveillance of critical locations; 

• Coordinating emergency plans as appropriate with nearby 
jurisdictions; 

• Assessing whether the precise characteristics of the threat require 
the further refinement of preplanned Protective Measures; and 

• Implementing, as appropriate, contingency and emergency 
response plans. 

4. High Condition (Orange). A High Condition is declared when there is a 
high risk of terrorist attacks. In addition to the Protective Measures taken in the 
previous Threat Conditions, Federal departments and agencies should consider 
the following general measures in addition to the agency-specific Protective 
Measures that they will develop and implement: 

• Coordinating necessary security efforts with Federal, State, and 
local law enforcement agencies or any National Guard or other 
appropriate armed forces organizations; 

• Taking additional precautions at public events and possibly 
considering alternative venues or even cancellation; 

• Preparing to execute contingency procedures, such as moving to 
an alternate site or dispersing their workforce; and 

• Restricting threatened facility access to essential personnel only. 

5. Severe Condition (Red). A Severe Condition reflects a severe risk of 
terrorist attacks. Under most circumstances, the Protective Measures for a 
Severe Condition are not intended to be sustained for substantial periods of time. 
In addition to the Protective Measures in the previous Threat Conditions, Federal 
departments and agencies also should consider the following general measures 
in addition to the agency-specific Protective Measures that they will develop and 
implement: 


Increasing or redirecting personnel to address critical emergency 
needs; 

Assigning emergency response personnel and pre-positioning and 
mobilizing specially trained teams or resources; 

Monitoring, redirecting, or constraining transportation systems; and 
Closing public and government facilities. 


From: Department of Homeland Security website 
http://www.dhs.qov/dhspublic/display?theme=29 , June 3, 2004 
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APPENDIX B. UTAH DEPARTMENT OF PUBLIC SAFETY 

HOMELAND SECURITY 


TERRORIST THREAT CONDITIONS 


THREAT 

CONDITION 

CRITICAL FACILITIES 
PROTECTIVE ACTION 

LOCAL GOVERNMENT 
ACTIONS 

ANTICIPATED PUBLIC RESPONSE 


Continue all precautions from 

Continue all precautions from 

In addition to all previously 


lower Threat Conditions. 

lower Threat Conditions. 

mentioned precautions, citizens are 
advised to: 


• Announce Threat Condition 

• Announce Threat Condition 

• Report suspicious activities and call 


SEVERE and explain expected 

SEVERE to employees and to the 

9-1-1 for immediate response. 


actions. 

public and explain anticipated 

• Expect delays, searches of purses 

s 

• Deploy security personnel based 

actions that should be taken. 

and bags and restricted access to 


on threat assessments. 

• Deny unauthorized access to 

public buildings. 


• Close or restrict entry to the facility 

critical facilities and infrastructure. 

• Expect traffic delays and restrictions. 


to emergency personnel only and 

Continue 100% inspections of 

• Take personal security precautions 

E 

restrict parking areas close to critical 

personnel, vehicles and packages. 

to avoid becoming a victim of crime or 

buildings. 

• Visually inspect the interior and 

terrorist attack. 


• Maintain a skeleton crew of 

undercarriage of vehicles entering 

• Avoid crowded public areas and 


essential employees. 

parking lots and terraces. 

gatherings. 

V 

• Deploy emergency response and 

• Deploy equipment assets and 

• Do not travel into areas affected by 

security teams. 

ensure physical security measures 

the attack or is an expected terrorist 

• Activate Operations Center and 

be afforded to them at critical sites. 

target. 


send a liaison to the county or state 

• Assemble trained volunteers to 

• Keep emergency supplies accessible 


EOC. 

assist in emergency operations. 

and automobile fuel tank full. 

E 

• Maintain close contact with local 

• Implement Mutual Aid 

• Be prepared to evacuate your home 

law enforcement. 

Agreements as required. 

or shelter in place on order of local 


• Be prepared to implement mutual 

• Continue to assess the 

authorities. 


aid agreements with government and 

vulnerability of key assets and 

• Report persons taking photographs of 


with other critical facilities. 

facilities. Take appropriate action 

critical facilities, asking detailed 

R 

• Provide security in parking lots 

to protect them by deploying 

questions about physical security or 


and company areas. 

armed security forces to these 

dressed inappropriately for weather 


• Report suspicious activity 

sites. 

conditions (suicide bomber) to law 


immediately to local law 

• Cancel or delay unnecessary 

enforcement authorities. 

E 

enforcement. 

employee travel and leave. 

• Closely monitor news reports and 

• Restrict or suspend all deliveries 

• Activate the Emergency 

Emergency Alert System (EAS) 


and mail to the facility. Emergency 

Operations Center. 

radio/TV stations. 


supplies or essential shipments 

• Control release of information to 

• Assist neighbors who may need help. 


should be sent to and off-site location 

the public and news media. 

• Avoid passing unsubstantiated 


for inspection. 

• Send a public Information 

Officer to the state Joint 

Information Center (JIC). 

• Provide security for personnel 
dispatched to repair or restore 
damaged facilities and systems. 

information and rumors. 
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Definition: A terrorist attack has occurred or credible and corroborated intelligence indicates that one is imminent. Normally, 
this threat condition is declared for a specific location or critical facility." 


THREAT CRITICAL FACILITIES 

CONDITION PROTECTIVE ACTION 


LOCAL GOVERNMENT 
ACTIONS 


ANTICIPATED PUBLIC RESPONSE 


Continue all precautions from 
lower Threat Conditions. 


Continue all precautions from 
lower Threat Conditions. 


In addition to all previously 
mentioned precautions, citizens are 


advised to: 


H 

I 

G 

H 


• Announce Threat Condition HIGH 
to all employees and explain 
expected actions. 

• Place emergency response teams 
on notice. 

• Activate the operations center if 
required. 

• Monitor world and local events. 
Pass on credible threat intelligence to 
key personnel. 

• Ensure appropriate security 
measures are in place and 
functioning properly. 

• Instruct employees to report 
suspicious activities, packages and 
people. 

• Search all personal bags, parcels 
and require personnel to pass 
through magnetometer, if available. 

• Restrict vehicle parking close to 
buildings. 

• Inspect intrusion detection 
systems and lighting, security fencing 
and locking systems. 

• Inspect all deliveries and consider 
accepting shipments only at off-site 
locations. 

• Remind employees to expect 
delays and baggage searches. 


• Announce Threat Condition 
HIGH to employees and public and 
explain expected actions to be 
taken. 

• Restrict or control access to 
government buildings, critical 
facilities and infrastructure. 

• Erect outside barricades, 
security checks to deny access to 
underground parking areas, 
loading docks and building 
entrance. 

• Require identification, sign-in 
and escorts as required. 

• Restrict parking areas located 
close to buildings or critical 
facilities. 

• Remove trash containers, 
dumpsters and mailboxes located 
near government buildings and 
facilities. 

• Closely monitor available 
security and intelligence data from 
state and local law enforcement 
agencies. 

• Instruct employees to be 
especially watchful for suspicious 
or unattended packages and 
articles received through the mail 
service. 

• Inspection buildings and parking 
areas for suspicious packages. 

• Implement rumor control to 
avoid public panic. 

• Employ armed security at 
airports, dams, public utilities and 
critical facilities. 

• Based on threat assessment, 
define rules of engagement and 
authorize use of deadly force. 

• Test communication plans. 

• Secure and regularly inspect all 
buildings, vehicles, and parking 
and storage areas for intrusion. 

• Conduct 100% verification of 
deliveries and restrict shipments. 


• Resume normal activities but expect 
some delays, baggage searches and 
restrictions as a result of heightened 
security at public buildings and facilities. 

• Continue to monitor world and local 
events as well as local government 
threat advisories. 

• Report suspicious activities at or 
near critical facilities to local law 
enforcement agencies by calling 9-1-1. 

• Avoid leaving unattended packages 
or brief cases in public areas. 

• Inventory and organize emergency 
supply kits and discuss emergency 
plans with family members. Reevaluate 
meeting location based on threat. 

• Consider taking reasonable personal 
security precautions. Be alert to your 
surroundings, avoid placing yourself in 
a vulnerable situation and monitor the 
activities of your children. 

• Maintain close contact with your 
family and neighbors to ensure their 
safety and emotional welfare. 
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Definition: Credible intelligence indicates that there is a high risk of a local terrorist attack but a specific target has not been 

identified. 


THREAT CRITICAL FACILITIES 

CONDITION PROTECTIVE ACTION 


LOCAL GOVERNMENT ACTIONS 


ANTICIPATED PUBLIC 
RESPONSE 


Continue all precautions 
from lower Threat 


Continue all precautions from lower 
Threat Conditions. 


In addition to all previously 
mentioned precautions, citizens 


Conditions. 


are advised to: 


E 


L 


E 


V 


A 


T 


E 


• Announce Threat 
Condition ELEVATED to 
employees. 

• Review vulnerability and 
threat assessments and 
revise as needed. 

• Identify and monitor 
governmental information 
sharing sources for warnings 
and alerts. 

• Update and test call down 
list for emergency response 
teams and key employees. 

• Review and coordinate 
and update mutual aid 
agreements with other critical 
facilities and government 
agencies. 

• Establish and monitor 
active and passive security 
measures. 

• Review employee training 
on security precautions 
(bomb threat procedures, 
reporting suspicious 
packages, activities and 
people). 

• Conduct communications 
checks to ensure radio 
contact can be established. 


• Announce Threat Condition ELEVATED 
to employees and to the public. 

• Review physical security plans for 
critical facilities. 


• Keep the public informed on current 
threat conditions and advisories. 

• Coordinate with adjacent municipalities 
for mutual aid support in the event of a 
disaster or terrorist threat. 

• Conduct tabletop and functional 
exercises to ensure that response plans 
are understood and current. 

• Review existing physical security 
measures employed and install intrusion 
detection systems as funding permits. 

• Conduct weekly radio communication 
checks. 


• Continue normal activities, but 
report suspicious activities to the 
local law enforcement agencies. 

• Take a first aid or Community 
Emergency Response Team 
(CERT) class. 

• Become active in your local 
Neighborhood Crime Watch 
program. 

• Network with your family, 
neighbors and community for 
mutual support during a disaster or 
terrorist attack. 

• Learn what critical facilities are 
located in your community and 
report suspicious activities at or 
near these sites. 

• Attend your local emergency 
planning committee (LEPC) 
meeting to learn more about local 
hazards. (Call the city/county 
emergency manager to learn dates 
and locations of the meetings.) 

• Increase individual or family 
emergency preparedness through 
training, maintaining good physical 
fitness and health, and storing 
food, water and emergency 
supplies. 


• Assess potential terrorist targets and 
develop plans to counteract an attack. 

• Conduct vulnerability assessments of 
each critical facility and government 
building. Estimate the consequence of 
loss and assign a priority for their 
protection. 

• Ensure all buildings are secured to 
prevent theft or tampering. 

• Conduct physical inspection of buildings 
for suspicious unattended packages. 

• Develop a cadre of trained volunteers. 

• Closely monitor current news events 
and state and federal terrorist advisories. 


D 
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DEFINITION: ELEVATED RISK OF TERRORIST ATTACK BUT A SPECIFIC REGION OF THE USA OR TARGET HAS NOT BEEN 



IDENTIFIED. 


THREAT 

CRITICAL FACILITIES 

LOCAL GOVERNMENT ACTIONS 

ANTICIPATED PUBLIC 

CONDITION 

PROTECTIVE ACTION 

RESPONSE 


Continue all precautions 

Continue all precautions from lower 

In addition to all previously 


from lower Threat 

Threat Conditions. 

mentioned precautions, citizens are 


Conditions. 


advised to: 

G 

• Ensure that key leaders 

• Estimate the threat vulnerability of 

• Continue normal activities but be 


are familiar with the 

each critical facility and the 

watchful for suspicious activities. 


emergency response and 

countermeasures required to protect 

Report criminal activity to local law 


business resumption plans. 

them. 

enforcement. 

U 

• Review, update and 

• Ensure that each department is familiar 

• Review family emergency plans. 

routinely exercise for 

with their assigned responsibilities during 

• Increase family emergency 


functional areas of plans. 

a disaster as shown in the plan and are 

preparedness by purchasing supplies, 


• Review and update the call 

prepared to respond. 

food and storing water. 


down list for emergency 

• Review communications plans and 

• Be familiar with local natural and 

A 

response teams 

ensure the call-down procedures are 

technological (man made) hazards in 


• Develop or review Mutual 

current and accurate. 

your community. 


Aid agreements with other 

• Conduct emergency management 

• Increase individual or family 


facilities and/or with local 

training and exercise emergency 

emergency preparedness through 

R 

government for use during 

response plans. 

training, maintaining good physical 

emergencies. 

• Ensure all emergency management 

fitness and health, and storing food, 


• Review physical security 

and response functions are adequately 

water and emergency supplies. 


precautions to prevent theft, 

staffed. Recruit and train volunteers to 

• Monitor local and national news for 


unauthorized entry or 

augment full time staff. 

terrorist alerts. 

D 

destruction of property. 

• Actively support the Neighborhood 

• Update immunizations. 


Have you provided for: 

Watch, Community Emergency Response 

• Volunteer to assist and support the 


• Employee picture 

Team (CERT) and other Freedom Corps 

community emergency response 


ID badges? 

programs. 

agencies. 

E 

• Background 

• Remind citizen and employees to be 


checks on all 

alert for suspicious packages, activities, 



employees? 

vehicles and to report these occurrences 



• Access control 

to the proper authority. 



and locking of high 

• Secure buildings, unused rooms, 


D 

security areas at all 

storage areas, equipment and vehicles to 



times? 

prevent theft, tampering or destruction. 



• All security keys 

• Evaluate information available on 



marked with “Do 

public websites that could compromise 



not Duplicate? 

security. 



• Surveillance 

• Encourage all citizens and employees 



Cameras? 

to have necessary immunizations. 



• Backup power? 

• An alarm system? 
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Definition: General Risk with no credible threats to specific targets. 


THREAT 

CRITICAL FACILITIES 

LOCAL GOVERNMENT ACTIONS 

ANTICIPATED PUBLIC 

CONDITION 

PROTECTIVE ACTION 

RESPONSE 


Managers of critical 
facilities are advised to: 

Local governments are advised to: 

Citizens are advised to: 


• Develop emergency 

• Identify critical facilities that may need 

• Continue to enjoy individual 


response and business 

protection. 

freedom. Participate freely in travel, 

L 

resumption plans. 

• Review Emergency Response Plans. 

work and recreational activities. 


• Encourage and assist 

• Conduct training, seminars, workshops 

• Be prepared for disasters and family 


employees to be prepared 

and exercises using the emergency 

emergencies. (See DESHS and 


for personal, natural and 

response plans. 

American Red Cross brochures.) 

0 

technological emergencies. 

• Conduct emergency preparedness 

• Develop a family emergency plan. 

• Develop a 

training for citizens and employees. 

(See DESHS and American Red Cross 


communications plan for 

• Encourage response agencies (fire 

brochures.) 


emergency response and 

fighters, law enforcement, EMS, public 

• Know how to turn off your power, 

W 

key personnel 

works and elected officials) to take 

gas and water service to your house. 

• Conduct training for 

emergency management and American 

• Know what hazardous materials are 

employees on physical 

Red Cross first aid and CPR training. 

stored in your home and how to 


security precautions. 

• Provide emergency preparedness 

properly dispose of unneeded 


• Budget for physical 

information to employees via paycheck 

chemicals. 


security measures. 

stubs tips, newsletters, articles and 
posters. 

• Conduct routine inventories of 
emergency supplies and medical aid kits. 

• Budget for physical security measures. 

• Encourage programs for employee 
immunization and preventive health care 

• Support the efforts of your local 
emergency responders (fire fighters, 
law enforcement and emergency 
medical service). 

• Know what natural hazards are 
prevalent in your area and what 
measures you can take to protect your 
family. 

Definition: Low risk of terrorism. Routine security is implemented to preclude routine criminal threats. 
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APPENDIX C. UTAH PUBLIC HEALTH AND MEDICAL SYSTEMS 
- HOMELAND SECURITY THREAT CONDITIONS PROTOCOLS 


Notifications and Communications 


REFERENCE 

NUMBER 

RECOMMENDATIONS / CONSIDERATIONS 

ENTITY 

GREEN 

BLUE 

YELLOW 

ORANGE 


Activate notification procedures far changes in threat levels 


X 

X 

X 

X 


Update call down rosters 


Quarterly 

Quarterly 

Quarterly 

Monthly 


Update outside agency contact lists 


Quarterly 

Quarterly 

Quarterly 

Monthly 


Disseminate security and intelligence data from state and local law 
enforcement agencies 


X 

X 

X 

X 


Keep staff informed on changing threat advisories. 


X 

X 

X 

X 


Provide timely information to employees to control rumors and 
misinformation. 


X 

X 

X 

X 


Establish communications with additional jurisdictions and 
institutional contacts, as needed 


X 

X 

X 

X 


Issue Public Health Alerts to local health care providers according 
to Alert Protocol 


X 

X 

X 

X 


Perform tests of communication between UDOH, LHD’s, hospital, 
and emergency response partners. 


Quarterly 

Quarterly 

Quarterly 

Monthly 


Ensure computers have adequate firewall protection and data are 
backed up on disks which are stored off campus. 


X 

X 

X 

X 


Epidemiology and Surveillance 


REFERENCE 

NUMBER 

RECOMMENDATIONS / CONSIDERATIONS 

> 

1- 

H 

z 

LU 

GREEN 

BLUE 

YELLOW 

ORANGE 


Conduct epidemilogic investigation; coordinate with law 
enforcement, UDOH, FBI as needed 







Activate Enhanced Surveillance Protocol and monitor community 
indicators 


X 

X 

X 

X 


Establish Public Health surveillance for potential toxic exposures 
following an emergency 







Determine need for isolation or quarantine measures and activate 
Protocol if needed 







Coordinate Veterinary Risk Assessment - Investigation - Control 
Measures 







Report clusters of illness, health syndromes and trends to the Utah 
Department of Health, Office of Epidemiology (1-888-374-8824). 


X 

X 

X 

X 
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Public Affairs 


REFERENCE 

NUMBER 

RECOMMENDATIONS / CONSIDERATIONS 

ENTITY 

GREEN 

BLUE 

YELLOW 

ORANGE 


Closely monitor news events 


X 

X 

X 

X 


Evaluate information on websites 


X 

X 

X 

X 


Update websites to provide up to date information to the 
community 


X 

X 

X 

X 


Actively support the Community Emergency Response Team 
(CERT) program 


X 

X 

X 

X 


Produce incentives, brochures, posters and educational materials 
for dissemination to the public 


X 

X 

X 

X 


Activate health department Emergency Media Plan 





Consider 


Alert food establishments, water, and others of Public Health 
threat if needed 





Consider 


Training 


REFERENCE 

NUMBER 

RECOMMENDATIONS / CONSIDERATIONS 

>- 

1- 

H 

Z 

III 

GREEN 

BLUE 

YELLOW 

ORANGE 


Train employees as appropriate to ensure their understanding of 
procedures for identifying and reporting suspicious activities, 
packages and bomb threats. 


X 

X 

X 

X 


Conduct training, exercises, and workshops to familiarize 
personnel with emergency response plans and responsibilities 


X 

X 

X 

X 
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APPENDIX D. IMPORTANT LESSONS LEARNED FROM THE 

ISRAELIS ON TERRORISM 


This appendix includes important lessons learned from the Israelis from 
over 55 years of dealing with terrorism. I think it is important to learn as much as 
possible from one of the top experts in the world. 

A. TERRORISM IN ISRAEL 

Terrorism in Israel started in 1948 and has remained consistent 
throughout this period to the present. The terror began with guerrilla raids and 
progressed to airline hijackings, hostage taking, and the attacks on Israeli 
athletes at the 1972 Summer Olympic Games in Munich, Germany. The most 
violent of the terrorist campaign was the attacks along the Tele Aviv-Haifa 
highway, attacking buses and cars and killing 35 and wounding 24 Israelis. The 
main organization campaigning against Israel is the Palestinian Liberation 
Organization (PLO) and is still around today. Many extremist organizations have 
split off of the PLO with many maintaining the same objectives against Israel. 62 

Early into the terrorism culture, the Israelis were concerned with two 
things; 1) most PLO attacks were against civilians and 2) Israeli governments are 
sensitive to civilian casualties. Therefore, the Israelis developed a sophisticated 
counter-terrorism system to develop defense measures designed to deter 
terrorist attacks and defend against civilian causalities. 63 Surprisingly enough to 
this day, the government does not have a formalized strategy or policy to deal 
with the challenges of the PLO. They adjust their actions to react to specific 
attacks as they occur. 


62 United States Library of Congress, Library of Congress Country Studies, Israel, December 
1988. 

63 Ariel Merari, “Israel’s Preparedness for High Consequence Terrorism,” Arnold M. Howitt, 
Robyn L. Pangi, Countering Terrorism, Dimension of Preparedness, 2003, John F. Kennedy 
School of Government, Harvard University. 
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The elaborate defensive measures implemented by the Israelis include 
target hardening, public participation and preemptive strikes and legal measures. 
This measure has been very successful against WMD attacks and is the reason 
for the increased suicide bombing because the larger acts of terrorism have been 
deterred. 

Today, suicide bombers are the medium of attack. Even with the 
extensive Israeli security and intelligence structure, a suicide bomber can walk 
into a market area or on to a school bus and kill many innocent people. Israel 
has implemented a very aggressive anti-suicide bomber campaign, which seems 
to be working. 64 Of all the violence Israel has dealt with hostage incidents and 
suicide bombers have imposed the most psychological and political damage on 
the country. In the last two years, over 600 Israelis have been killed in 13,000 
attacks. 65 

Throughout, Israeli society remains determined to resist the effects of 
violence on their way of life. Many citizens including women and children have 
died and unfortunately will continue to die. Their society accepts or tolerates the 
actions of the terrorists. The Israelis have strengthened themselves to deal with 
this terror everyday. To give in, to fail and to acknowledge the success of 
terrorism on their country, is not acceptable. Therefore, the culture adjusts, 
response measures are implemented and society continues. 

The military and the Israelis police have taken appropriate response 
measures against the PLO for each act of terror. However, the most successful 
response initiated by the Israelis is education and the training of the citizens. 
Public awareness is the single most important element of success in the fight on 
terrorism. 66 There are 55 years of lessons learned from terrorist attacks; the 

64 Hoffman, Mark, “The Logic of Suicide Terrorism,” The Atlantic Monthly, June 2003, pp. 40- 
47. 

65 Ibid., p. 19. 

66 The Israel Experience in Homeland Security, Presentation and briefing at the National 
Emergency Management Association meetings Washington DC, February 2003, There are four 
points to the Israelis program and they are Public Awareness and Participation, Coordinating the 
Response Elements, Israel Defensive Force (IDF) Command and NBC Preparedness, Hospital 
Preparedness and the National Center for Medical Simulation. 
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United States should take note of for potential response measures and educating 
citizens. Israel has implemented an extensive terrorism response measures that 
has been developed from trial and error throughout the years. 

B. PUBLIC AWARENESS AND PARTICIPATION 

The Israelis believe terrorism is a means of “warfare using all possible 
means, both physical and psychological against its targets. Psychological 
warfare is the only existing warfare in which the target remains intact while the 
means are those that get killed or destroyed.” 67 The targets, in this case, are the 
citizens of Israel and the only way to fight terrorism is to get the target audience 
involved. 

The purpose of the terrorist act is to change the beliefs or behaviors of an 
individual, group or government. The Israelis strategy is to have the public 
involved in every level of the fight and change behavior. 

The Israelis engaged in an extensive cooperative effort between the 
police, security agencies and the public. It was determined there needed to be a 
new culture and a new strategy to win the war on terrorism. The goals of 
cooperation were: 

• Prevent terrorism and minimize damage 

• Prevent public panic and extreme reactions 

• Channel the public to act productively 

• Develop a communications infrastructure 68 

The key to reducing fear is the get the public educated, involved and 
increase the awareness of terrorism. Training of the Israelis included: 
preparedness, motivation, security measures prior to an attack, reactive behavior 
to an attack, how to communicate and emergency planning and exercise, etc. 


67 The Israel Experience in Homeland Security, Presentation and briefing at the National 
Emergency Management Association meetings Washington DC, February 2003, contact 
www.tix.co.il for more information on their presentation, Accessed May 2004. 

68 Ibid., p. 23. 
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The Israelis started the civil guard in 1974, which worked directly with the 
national police. By 1982, there were 84,000 volunteers, 1,200 commanders and 
paid staff. 69 Today the numbers are down to approximately 50,000. Each must 
serve four hours per month with their neighborhood patrols. 

Israeli citizens became experts in many fields as volunteers, for response, 
notification, clean up, victim identification, first aid, recovery, bomb squads and 
SWAT teams. The level of expertise and skill in each specialty area is 
impressive, but is vital to the success they have for treating a suicide bomb site 
like a traffic accident. The Israeli citizens have been well trained in terrorist 
identification skills averaging 600 calls per day to authorities on suspicious 
activity. The average confirmation of activity is .09%. 70 

The Israeli success on fighting terrorism has been attributed to the 
involvement of the citizens through formalized participation and the public 
alertness and awareness campaign. The majority of the bombs placed in public 
locations have been identified by the public and many of the bombs were 
neutralized before they could detonate. The Israeli police produce commercials 
on TV and utilize other mediums to enhance public awareness. The bottom line 
is terrorism in Israel is a concern to everyone and a high priority. They are 
determined to succeed. 71 Get in, clean it up and move on. 

The fear of terror is reduced by involvement and awareness. The task 
was not easy and did not happen overnight, it took a new generation, a new 
strategy, a high priority and proactive approach to be successful. 

C. ISRAELIS SUMMARY POINTS 

• The Israelis have endured 55 years of terrorism through WMD 
attacks and suicide bombers. 

• The Israelis do not have an official documented strategy, they 
manage to adjust and implement very aggressive counter terrorism 
measures. 


69 Ibid., 20. 

70 Ibid., 23. 

71 Ibid., p. 20. 
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• They are successful because of the proactive public awareness 
and involvement campaign. 

• Israel does not have a Homeland Security Advisory System they 
invoke a state of emergency alert, which activates security and 
response measures. 

• The citizens are involved at every level of response and 
awareness. This dedication has reduced the level of psychological 
harm. 

• Suicide bombers and the threat of chemical or biological attach still 
weigh heavy on the minds of the citizens. 

• The war on terrorism is a high priority. 

The Israelis case concluded that thru aggressive counter-terrorism 
measures and proactive involvement of the public, WMD acts can be deterred or 
mitigated. Fear of civilians will diminish through communicating and involving the 
public in every element of counter terrorism system. Warning systems are not 
needed but a robust response system through repetition by all Israelis helps in 
reassuring the public. 

• Open source intelligence, shared throughout public safety 

• A horizontal and vertical communication system and protocol to 
disseminate information 
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